This week we have bulk disclosures from FortiGuard (6). We have 11 additional vendor disclosures from ABB, Bosch (4), HPE (4), Mitsubishi, and Philips.
Bulk Disclosures - FortiGuard
ABB Advisory
ABB published an advisory that describes an authentication bypass using alternate path or channel vulnerability in their Edgenius Management Portal. ABB has a new version that mitigates the vulnerability.
Bosch Advisories
Bosch published an advisory that discusses two vulnerabilities in their MAP 5000 family. These are third-party vulnerabilities. Bosch has a new version that mitigates the vulnerability.
The two reported vulnerabilities are:
NULL pointer dereference - CVE-2021-3449,
Improper validation of integrity check value - CVE-2023-48795 (exploit).
Bosch published an advisory that describes an inadequate encryption strength vulnerability in their MAP 5000 panel. Bosch has a new version that mitigates the vulnerability.
Bosch published an advisory that discusses a double free vulnerability in their MAP 5000 family. This is a third-party (OpenSSH) vulnerability. Bosch has a new version that mitigates the vulnerability.
Bosch published an advisory that describes a use of a broken or risky cryptographic algorithm vulnerability in their MAP 5000 family. Bosch has a new version that mitigates the vulnerability.
HPE Advisories
HPE published an advisory that discusses three vulnerabilities in their Telco Service Activator. These are third-party vulnerabilities. HPE has a new version that mitigates the vulnerabilities.
The three reported vulnerabilities are:
Allocation of resources without limit or throttling (2) - CVE-2025-9784 and CVE-2025-8916, and
Uncontrolled resource consumption - CVE-2025-48795.
HPE published an advisory that discusses an improper isolation or compartmentalization vulnerability in their Compute Scale-up Server 3200 Platform Servers. This is a third-party (Intel) vulnerability. HPE has a new version that mitigates the vulnerability.
HPE published an advisory that describes seven vulnerabilities in their Aruba Networking Management Software (AirWave). Six of the vulnerabilities are third-party (Red Hat) vulnerabilities. The vulnerabilities were reported by Simon Scannel, Pedro Gallegos, and Jasiel Spelman from Google Cloud Vulnerability Research, Aleksei Gorban, and Michael Smolinski. HPE has a new version that mitigates the vulnerabilities.
The seven reported vulnerabilities are:
Command Injection - CVE-2025-37163,
Out-of-bounds write - CVE-2024-12084 (exploit),
Use of uninitialized resource - CVE-2024-12085 (exploit),
Detection of error condition without action - CVE-2024-12086 (exploit),
Path traversal (2) - CVE-2024-12087 (exploit) and CVE-2024-12088 (exploit),
Race condition - CVE-2024-12747.
HPE published an advisory that discusses 13 vulnerabilities in their Aruba Networking AOS-CX. Ten of these are third-party vulnerabilities. The vulnerabilities were reported by zzcentury from Ubisectech Sirius Team, Qualys Threat Research Unit, Angelo Catalani and Giacomo Gloria from Italian National Cybersecurity Agency, Simon Scannel, Pedro Gallegos, and Jasiel Spelman from Google Cloud Vulnerability Research, Aleksei Gorban.
The following reported vulnerabilities have publicly available exploits,
Out-of-bounds write - CVE-2024-12084 (exploit),
Use of uninitialized resource - CVE-2024-12085 (exploit),
Detection of error condition without action - CVE-2024-12086 (exploit),
Path traversal - CVE-2024-12087 (exploit), CVE-2024-12088 (exploit),
Cross-site scripting - CVE-2024-37160 (includes POC code).
Mitsubishi Advisory
Mitsubishi published an advisory that describes an uncontrolled search path element vulnerability in their MILCO.S lighting control system. The vulnerability was reported by Kazuma Matsumoto of GMO Cybersecurity. Mitsubishi has a new version that mitigates the vulnerability.
Philips Advisory
Philips published an advisory that discusses a Microsoft double free vulnerability that is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Philips lists four products that are affected. Philips provides a patch for one of the affected products and recommends applying the Microsoft update to the remaining three products.