2 Advisories and 1 Update Published – 10-28-25

Today CISA’s NCCIC-ICS published one control system and one medical device security advisory for products from Schneider and Vertikal Systems. They also updated an advisory for products from Schneider.

Schneider Advisory

This advisory describes an allocation of resources without limit or throttling vulnerability in the Schneider EcoStruxure OPC UA Server Expert and EcoStruxure Modicon Communication Server. The vulnerability was reported by Jin Huang of ADLab of Venustech. Schneider has a new version for the OPC UA server that mitigates the vulnerability. Schneider provides generic mitigation measures pending development of a fix for the Modicon Communications server.

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to result in the loss of real-time process data from the Modicon Controller.

NOTE: I briefly discussed this vulnerability on October 19^th, 2025.

Vertikal Advisory

This advisory describes two vulnerabilities in the Vertikal Hospital Manager Backend Services. The vulnerabilities were reported to CISA by Pundhapat Sichamnong. CISA reports that Vertikal fixed the two vulnerabilities on September 19^th, 2025.

The two reported vulnerabilities are:

• Exposure of sensitive information to an unauthorized control sphere - CVE-2025-54459, and

• Generation of error message containing sensitive information - CVE-2025-61959

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to obtain unauthorized access to and disclose sensitive information.

NOTE: It is not clear from the advisory nor the Vertikal’s web site whether this was fixed on software run on owner systems or if the vendor maintains this software as a cloud system. In either case this would indicate some level of lack of security control for the product, unless the fix was pre-coordinated with the system owner.

Schneider Update

This update provides additional information on the Modicon advisory that was originally published on December 17^th, 2024, and most recently updated on March 18^th, 2025. The new information includes adding remediation for Modicon M258 / LMC058

NOTE: I briefly mentioned the Schneider update on October 19^th, 2025.