Industrial Control System

An unauthenticated remote command injection vulnerability in Phoenix Contact CHARX SEC controllers allows attackers to execute arbitrary code as root via malformed system configuration inputs.

A critical vulnerability (CVE-2026-44090) in Phoenix Contact CHARX SEC controllers allows unauthenticated remote attackers to gain full device control by bypassing authentication on the MQTT broker.

A high-severity missing authorization vulnerability, CVE-2026-14168, allows a low-privileged remote attacker to escalate privileges to administrator level by exploiting the insert path of the configuration table in ads-tec Industrial IT DVG-IRF series products, ultimately granting full system access.

A low-privileged local attacker can exploit CVE-2026-14837, an improper signature verification vulnerability, in multiple Lenze products including models c430, c520, c550, i950 GenA, and i950 GenB to bypass the verification of the SSH enable file signature, subsequently enabling SSH access on the affected device, resulting in unauthorized administrative access and complete system compromise.

CVE-2026-14448 describes an authenticated OS command injection vulnerability in the system_certificates view of MB connect line's mbCONNECT24 and mymbCONNECT24 products, as well as Helmholz's myREX24V2 and myREX24V2.virtual products, all versions up to and including 2.20.0, allowing a high-privileged remote attacker to execute arbitrary commands leading to a total loss of confidentiality, availability, and integrity.

A vulnerability, identified as CVE-2026-14354, exists in Schneider Electric EcoStruxure Cybersecurity Admin Expert versions prior to or equal to 4.2.0, allowing an attacker to bypass the product's security policy, potentially leading to unauthorized access or actions.

CVE-2025-41669 allows a remote, low-privileged engineer user to install additional, potentially malicious, applications on the PLCnext Control device without data verification, leading to arbitrary code execution with root privileges and impacting system integrity and availability.

A vulnerability, CVE-2025-11482, exists in ABB's PPT30 Operating System related to handling concurrent connections in the PPT30 OPC-UA Server, affecting versions prior to 1.8.0.

Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 is vulnerable to SQL injection (CVE-2018-25333), allowing unauthenticated attackers to execute arbitrary SQL queries and extract sensitive information via crafted POST requests to login.php.

A vulnerability in ABB's IEC 61850 communication stack allows a remote attacker with access to the IEC 61850 network to cause a denial-of-service condition by sending a specially crafted packet, leading to device faults or communication driver crashes.

A path traversal vulnerability in ABB PCM600 versions 1.5 to 2.13 (CVE-2018-1002208) allows a local attacker with low privileges to execute arbitrary code by sending a specially crafted message to the system node.

Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.

CVE-2026-33892 allows an unauthenticated remote attacker to bypass authentication and impersonate a legitimate user in affected Industrial Edge Management Pro and Virtual versions by exploiting improper enforcement of user authentication on remote connections to devices, potentially enabling unauthorized access and control.

A low-privileged remote attacker can exploit CVE-2026-4436 by sending Modbus packets to manipulate register values controlling odorant injection in gas lines, potentially leading to hazardous conditions.

CVE-2025-13926 describes a vulnerability in Contemporary Controls BASC 20T that allows an attacker to sniff network traffic and forge packets to make arbitrary requests, potentially leading to unauthorized actions.

Team82 disclosed vulnerabilities in Schneider Electric Modicon Controllers M241, M251, and M262 PLC lines, which can allow an attacker to cause a denial-of-service condition and affect controller availability.