Public ICS Disclosures – Week of 11-29-25 – Part 1

This is a moderately busy disclosure week. We bulk disclosures from HPE (9). We also have nine additional vendor disclosures from CODESYS (3), Hitachi Energy, HP, Medtronic, Meinberg, and Philips (2).

Bulk Disclosures – HPE

• HPESBHF04944 rev.1 - HPE Superdome Flex 280 and Compute Scale-up Server 3200 Platform Servers Using Certain Intel Processors, INTEL-SA-01280, 2025.3 IPU, Intel Chipset Firmware Advisory, Multiple Vulnerabilities,

• HPESBNW04974 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities,

• HPESBNW04976 rev.1 - HPE Virtualized Telecommunication Management Information Platform (vTeMIP), Multiple Vulnerabilities,

• HPESBNW04972 Rev. 1 - HPE Telco Network Function Virtual Orchestrator, Multiple Vulnerabilities,

• HPESBUX04977 rev.1 - HP-UX Using OpenSSL, Memory Corruption and Remote Code Execution Vulnerabilities,

• HPESBCR04979 rev.1 - HPE Cray XD670 Server Using Certain Intel Processors, INTEL-SA-01280, 2025.3 IPU, Intel Chipset Firmware Advisory, Multiple Vulnerabilities,

• HPESBCR04980 rev.1 - HPE Cray XD670 Server Using Certain Intel Processors, INTEL-SA-01312, Intel TDX Module Advisory, Multiple Vulnerabilities,

• HPESBCR04981 rev.1 - HPE Cray XD670 Server Using Certain Intel Processors, INTEL-SA-01313, 2025.3 IPU, Intel Xeon Processor Firmware Advisory, Multiple Vulnerabilities,

• HPESBCR04982 rev.1 - HPE Cray XD670 Server Using UEFI, Multiple Vulnerabilities.

CODESYS Advisories

CODESYS published an advisory that describes an out-of-bounds read vulnerability in their Control runtime system. The vulnerability was reported by ABB. CODESYS has new versions that mitigate the vulnerability.

CODESYS published an advisory that describes a type confusion vulnerability in their Control runtime system’s CmpVisuServer component. CODESYS has new versions that mitigate the vulnerability.

CODESYS published an advisory that describes a deserialization of untrusted data vulnerability in their Development System. The vulnerability was reported by MengyuXia of Beijing Aerospace Wanyuan Science & Technology. CODESYS has a new version that mitigates the vulnerability.

Hitachi Energy Advisory

Hitachi Energy published an advisory that discusses a deserialization of untrusted data vulnerability in their React Server Components. This is a third-party (Meta) that has been listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Hitachi Energy provides generic mitigation measures pending development of a fix.

NOTE: I never thought that I would be adding a link to a Facebook security advisory in one of my Public ICS Disclosure blog posts.

HP Advisory

HP published an advisory that describes a race condition enabling link following vulnerability in their Image Assistant product. The vulnerability was reported by WithSecure Exposure Management. HP has a SoftPaq that mitigates the vulnerability.

Medtronic Advisory

Medtronic published an advisory that describes four vulnerabilities in their CareLink Network web application. The vulnerabilities were discovered at the Biohacking Village at DEF CON 33. Medtronic has updated the online version of the product, no user action is required.

The four reported vulnerabilities are:

• Observable response discrepancy - CVE-2025-12994,

• Improper restriction of excessive authentication attempts - CVE-2025-12995,

• Insertion of sensitive information into log files - CVE-2025-12996, and

• Authorization bypass through user-controlled key - CVE-2025-12997

Meinberg Advisory

Meinberg published an advisory that discusses three vulnerabilities in their LANTIME product. These are third-party vulnerabilities. Meinberg has a new version that mitigates the vulnerability.

The three reported vulnerabilities are:

• Improper handling of invalid use of special elements - CVE-2025-61984 (exploit),

• Improper neutralization of NULL byte or NULL character - CVE-2025-61985, and

• Acceptance of extraneous untrusted data with trusted data - CVE-2025-11411.

Philips Advisories

Philips published an advisory that discusses the Meta React Server Components vulnerability that was added to CISA’s KEV catalog. Philips reports that none of their products are affected.

Philips published an advisory that discusses the Vercel NEXT.js vulnerability that is associated with the Meta React Server vulnerability. Philips reports that none of their products are affected.

NOTE: NVD.NIST.gov has ‘rejected’ CVE-2025-66478, noting that it is a duplicate of CVE-2025-55182 (the Meta RSC vulnerability).