Today CISA’s NCCIC-ICS published 7 control system security advisories for products from Delta Electronics, Stonefly, B&R Automation, Schneider (2) Frangoteam, and Mitsubishi. They also published a medical device security advisory for products from OFFIS. Includes down-the-rabbit-hole (DTRH) looks at the Frangoteam and Mitsubishi advisories.
Advisory Summaries
Delta Advisory - This advisory describes two vulnerabilities in the Delta Electronics DVP12SE PLC.
StoneFly Advisory - This advisory This advisory describes five vulnerabilities in the StoneFly Storage Concentrator.
B&R Advisory - This advisory discusses a race condition within a thread vulnerability in multiple B&R products. This is a third-party (XZ Utils) vulnerability.
Schneider Advisory #1 - This advisory describes two vulnerabilities in the Schneider Electric EasyLogic T150 and Saitel DP RTU.
Schneider Advisory #2 - This advisory describes an improper restriction of XML external entity reference vulnerability in the Schneider Electric EcoStruxure IT Data Center Expert.
Frangoteam Advisory - This advisory describes an authentication bypass by spoofing vulnerability in the Frangoteam FUXA SCADA/HMI.
Mitsubishi Advisory - This advisory discusses four vulnerabilities in the Mitsubishi MELSOFT Update Manager SW1DND-UDM-M. These are third-party (7-ZIP) vulnerabilities.
OFFIS Advisory - This advisory describes five vulnerabilities in the OFFIS DCMTK Toolkit.
Frangoteam DTRH
The NVD.NIST.gov entry for CVE CVE-2026-13207 provides a link to a Frangoteam Releases page that provides a summary of changes made in new versions of their FUXA SCADA/HMI product that is the target of today’s CISA Advisory ICSA-26-181-02, summarized above. That advisory recommends updating to v 1.3.2. The Fuxa Releases page lists the following security issues addressed in that version:
Unauthenticated SSRF via Socket.IO (#2344)
Scheduler admin authorization validation (#2345)
Path normalization in API routing
An even newer version has also been released; v1.3.3. The Fuxa Releases page lists the following security issues addressed in that version:
Webcam image authorization (#2397)
Harden vulnerable runtime dependencies (#2378)
Harden JWT lifecycle and Socket.IO administrative operations (#2379)
Enforce Node-RED authorization (#2393)
Improve settings sanitization and role deletion cleanup (#2394)
No CVE numbers or CWE descriptions have been provided.
Mitsubishi DTRH
The following vulnerabilities listed in today’s Mitsubishi advisory have publicly available exploits:
Heap-based buffer overflow - CVE-2025-53816 (exploit),
NULL pointer dereference - CVE-2025-53817 (exploit), and
Link following - CVE-2025-55188 (exploit).
NOTE: I am making changes to the way that I deal with cybersecurity advisories in this blog. The way that I have been handling these advisories has been time consuming and does not appear to add anything of significance to the discussion. So, I am going to try to just include the generic advisory summary that I have been publishing on Chemical Facility Security News for the last three years or so. I will add more DTRH sections to these posts that provide additional information not provided by CISA or the vendors in their advisories.