CISA Releases Nine Industrial Control Systems Advisories

The Cybersecurity and Infrastructure Security Agency (CISA) has once again underscored the persistent and evolving threats to critical infrastructure by releasing a batch of nine new Industrial Control Systems (ICS) advisories on July 22, 2025. These advisories highlight a range of vulnerabilities across various products from prominent vendors, urging organizations to take immediate action to mitigate potential risks to essential services.

The recently published advisories detail security flaws that could lead to significant disruptions, including denial-of-service, information disclosure, and even remote code execution. Among the affected vendors are key players in the industrial automation landscape such as Schneider Electric, DuraComm, and Lantronix. The vulnerabilities impact a wide array of products, from power monitoring devices and imaging software to critical controllers used in diverse sectors including energy, manufacturing, and commercial facilities.

Specifically, CISA’s latest release includes advisories covering:

• DuraComm DP-10iN-100-MU: Addressing vulnerabilities in power supply units.
• Lantronix Provisioning Manager: Highlighting flaws in device management software.
• Schneider Electric EcoStruxure, EcoStruxure Power Operation, System Monitor Application, EcoStruxure IT Data Center Expert, Modicon Controllers (Update A), and EVLink WallBox (Update A): A complete set of advisories for various Schneider Electric products, indicating a broad scope of potential exploitation.
• Schneider Electric Vijeo Designer (Update A): An update to a previously identified vulnerability in their HMI software.

The severity of these vulnerabilities varies, with several posing a significant risk due to their potential for remote exploitation and low attack complexity. CISA emphasizes that successful exploitation of these flaws could allow malicious actors to gain unauthorized access, manipulate system configurations, disrupt operations, or exfiltrate sensitive data. Such attacks could have cascading effects, impacting critical services and potentially top to real-world consequences.

CISA strongly urges all users and administrators of affected ICS to review the detailed advisories immediately. The agency recommends a multi-pronged approach to mitigation, including applying vendor-provided patches, implementing robust network segmentation between IT and OT networks, enforcing strong authentication mechanisms, and regularly conducting vulnerability assessments.

This latest release serves as a stark reminder of the continuous need for vigilance and proactive cybersecurity measures in the industrial control systems domain, where the intersection of physical and digital worlds makes robust defense paramount.