This week is a moderately busy disclosure week. For Part 1 we have 13 vendor disclosures from Carrier (3), Dassault Systems (2), Eaton, Hitachi, Janitza, Mitsubishi, Moxa (3), and Splunk.
Carrier Advisories
NOTE: I expect that CISA will publish advisories for these vulnerabilities in the coming week.
Carrier published an advisory that describes two vulnerabilities in the multiple Carrier and Automated Logic products. Carrier has new versions that mitigate the vulnerabilities. Four of the affected products are end-of-life and are not being fixed.
The two reported vulnerabilities are:
Incorrect authorization - CVE-2024-5539, and
Cross-site scripting - CVE-2024-5540
Carrier published an advisory that describes an improper validation of array index vulnerability in multiple Carrier and Automated Logic products. Carrier has new versions that mitigate the vulnerabilities. Five of the affected products are end-of-life and are not being fixed.
Carrier published an advisory that describes an improper input validation vulnerability in Carrier and Automated Logic Zone Controllers. Carrier has a new firmware version that mitigates the vulnerability.
Dassault Systems Advisories
Dassault published an advisory that describes a cross-site scripting vulnerability in their ENOVIA Product Manager. Remediation information is only available to registered users.
Dassault published an advisory that that describes a cross-site scripting vulnerability in their DELMIA Service Process Engineer product. Remediation information is only available to registered users.
Eaton Advisory
Eaton published an advisory that describes a path traversal vulnerability in their Galileo Software. The vulnerability was reported by Luca Borzacchiello of Nozomi Networks. Eaton has a new version that mitigates the vulnerability.
Hitachi Advisory
Hitachi published an advisory that discusses three vulnerabilities in multiple Hitachi products. These are third-party vulnerabilities. Hitachi has new versions for two of the affected products. Other fixes are pending.
Janitza Advisory
CERT-VDE published an advisory that describes an improper validation of specified type of input vulnerability in the Janitza UMG 96-PA and UMG 96-PA-MID products. The vulnerability was reported by Milence - Commercial Vehicle Charging Europe. Janitza has a new version that mitigates the vulnerability.
Mitsubishi Advisory
Mitsubishi published an advisory that describes a cleartext storage of sensitive information vulnerability in their GX Works2 product. The vulnerability was reported by Jiho Shin of Sungkyunkwan University. Mitsubishi provides generic mitigation measures pending development of a fix.
NOTE: I expect that CISA will publish an advisory for this vulnerability in the coming week.
Moxa Advisories
Moxa published an advisory that describes a clickjacking vulnerability in their ioLogik E1200 Series and E 2200 series products. The vulnerability was reported by Tenable. Moxa has a new firmware version for the E1200 series products and provides generic mitigation measures for the E2200 series products.
Moxa published an advisory that describes a password autocompletion vulnerability in their ioLogik E1200 Series and E 2200 series products. The vulnerability was reported by Tenable. Moxa has a new firmware version for the E1200 series products and provides generic mitigation measures for the E2200 series products.
Moxa published an advisory that describes a cleartext transmission of sensitive information vulnerability in their ioLogik E1200 Series and E 2200 series products. The vulnerability was reported by Tenable. Moxa provides generic mitigation measures.
Splunk Advisories
Splunk published an advisory that describes an insertion of sensitive information into a log file vulnerability in their Add-On for Palo Alto Networks. Splunk has a new version that mitigates the vulnerability.
Splunk published an advisory that discusses three vulnerabilities in their SOAR product. These are third-party vulnerabilities. Splunk has a new version that mitigates the vulnerabilities.
The four reported vulnerabilities are:
Path traversal - CVE-2025-47273 (includes proof-of-concept code),
Improper neutralization of special elements used in a template - CVE-2024-56326, and
Inefficient regular expression complexity - CVE-2025-27789