For Part 2 we have five additional vendor disclosures from Siemens (2), Supermicro, Wireshark (2), and Zyxel. There is one vendor update from Siemens. There is one researcher report on a vulnerability in products from FortiGuard. Finally, we have three separate exploits published for the same FortiGuard vulnerability.
Siemens Advisories
Siemens published an advisory that describes an out-of-bounds read vulnerability in their PS/IGES Parasolid Translator Component. The vulnerability was reported by the Zero Day Initiative. Siemens has a new version that mitigates the vulnerability.
Siemens published an advisory that describes a cross-site scripting vulnerability in their Mendix RichText editor. Siemens has a new version that mitigates the vulnerability.
Supermicro Advisory
Supermicro published an advisory that discusses four stack-based buffer overflow vulnerabilities in their BMC Firmware. The vulnerabilities were reported by Hoang Bui from Coreweave. Supermicro is testing a new version that mitigates the vulnerabilities.
Wireshark Advisories
Wireshark published an advisory that describes a Kafka dissector crash vulnerability. Wireshark has new versions that mitigate the vulnerability.
Wireshark published an advisory that describes a BPv7 dissector crash vulnerability. Wireshark has a new version that mitigates the vulnerability.
Zyxel Advisory
Zyxel published an advisory that describes two vulnerabilities in multiple Zyxel product lines. The vulnerabilities were reported by Iván Domínguez from Zerolynx and Joni Gadd. Zyxel has new versions that mitigate the vulnerabilities.
The two reported vulnerabilities are:
Uncontrolled resource consumption - CVE-2025-6599, and
OS command injection - CVE-2025-8693
Siemens Update
Siemens published an update for their Nozomi Guardian/CMC advisory that was originally published on August 12, 2025, and most recently updated on October 14th, 2025. The new information includes adding remediation for RUGGEDCOM APE1808.
FortiGuard Report
Bishop Fox published a report about an exploit for a relative path traversal vulnerability in the FortiGuard FortiWeb product. The vulnerability was previously disclosed by FortiGuard and CISA has added the vulnerability to their Known Exploited Vulnerabilities (KEV) catalog.
FortiGuard Exploits
NOTE: These exploits are all for the same FortiWeb vulnerability discussed above. This is a real popular vulnerability.
Nu11secur1ty published an exploit for the path traversal vulnerability in the FortiWeb product.
Verylazytech published an exploit for the path traversal vulnerability in the FortiWeb product.
SensePost published an exploit for the path traversal vulnerability in the FortiWeb product. While PacketStorm.com lists this as ‘an exploit’, they describe it as “Simple Python helper to probe Fortinet/FortiWeb targets for the fwbcgi authentication bypass pattern reported by watchTowr Labs.”