ICS & OT Security Advisories — Curated Dataset
PlayCISO maintains a curated dataset of 41 representative ICS and OT security advisories covering vendors like Siemens, Schneider Electric and Rockwell Automation, with CVEs, CVSS base scores, affected sectors and mitigations. The dataset spans 29 vendors and 11 critical-infrastructure sectors, references 58 distinct CVEs, covers advisories from 2013 to 2026, and flags 8 entries with publicly documented real-world exploitation. It is a teaching sample in the style of CISA ICS-CERT bulletins — not a live feed — built to help security leaders learn how ICS vulnerabilities are classified, prioritised by CVSS band, and mitigated.
Operational technology — the PLCs, RTUs, HMIs, SCADA servers, safety instrumented systems and building-management controllers that run physical processes — fails differently from IT. A vulnerable controller does not just leak data; it can open a breaker, move a chemical setpoint, or stop a safety function. This dataset collects 41 well-known, representative advisories so you can study the shapes those risks take: which vulnerability classes recur (default credentials, missing authentication, buffer overflows), which vendors and sectors they touch, how CVSS bands prioritise them, and what mitigations actually reduce exposure.
Of the 41 advisories, 19 fall in the Critical CVSS band (≥9.0) and 21 in the High band (7.0–8.9). Browse them interactively, filter and prioritise in the ICS Advisory Explorer, or read the broader context in the OT / ICS security hub.
The advisories
All 41 entries, verbatim from the dataset. CVSS cells are coloured by band (Critical, High, Medium). A ● in the ITW column flags exploited-in-the-wild. A ~ after a score marks a banded/approximate value (the advisory spanned several CVEs).
| ID | Vendor / products | CVE(s) | CVSS | Class | ITW | Year |
|---|---|---|---|---|---|---|
| ICSA-SIM-0001 | Siemens SIMATIC S7-1200 CPU, SIMATIC S7-1500 CPU | CVE-2020-15782 | 8.1 High | Improper Access Control, Authentication Bypass | — | 2021 |
| ICSA-SIM-0002 | Siemens SIMATIC WinCC, SIMATIC PCS 7 | CVE-2019-10916 | 9.1 Critical | Hardcoded / Default Credentials, Improper Access Control | — | 2019 |
| ICSA-SCH-0003 | Schneider Electric Modicon M221 PLC, EcoStruxure Machine Expert Basic | CVE-2020-7566 CVE-2020-7567 | 7.5~ High | Cryptographic Weakness, Authentication Bypass | — | 2020 |
| ICSA-SCH-0004 | Schneider Electric Triconex Tricon MP model 3008 | CVE-2018-8872 CVE-2018-7522 | 10.0~ Critical | Improper Access Control, Code / Firmware Injection | ● | 2018 |
| ICSA-RCK-0005 | Rockwell Automation ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 | CVE-2021-22681 | 10.0 Critical | Authentication Bypass, Cryptographic Weakness | — | 2021 |
| ICSA-RCK-0006 | Rockwell Automation FactoryTalk Services Platform, FactoryTalk View SE | CVE-2023-2071 | 9.8~ Critical | Missing Authentication, Command Injection | — | 2023 |
| ICSA-MOX-0007 | Moxa NPort 5100 series, NPort 5200 series, NPort IA5000A | CVE-2016-9361 CVE-2020-25159 | 9.8~ Critical | Hardcoded / Default Credentials, Buffer Overflow | — | 2020 |
| ICSA-MOX-0008 | Moxa EDR-810, EDR-G902, EDR-G903 | CVE-2021-39279 CVE-2021-39278 | 8.8~ High | Authentication Bypass, Cross-site Scripting | — | 2021 |
| ICSA-GE-0009 | GE Digital Proficy iFIX, Proficy CIMPLICITY | CVE-2022-46732 | 7.8~ High | Improper Access Control, Path Traversal | — | 2022 |
| ICSA-EMR-0010 | Emerson ControlWave Micro RTU, OpenBSI | CVE-2022-29303 | 9.1~ Critical | Hardcoded / Default Credentials, Missing Authentication | — | 2022 |
| ICSA-ABB-0011 | ABB System 800xA, Symphony Plus | CVE-2021-22284 | 7.5~ High | Denial of Service, Buffer Overflow | — | 2021 |
| ICSA-HON-0012 | Honeywell Experion PKS, Experion LX, Experion PlantCruise | CVE-2023-25078 CVE-2023-24474 | 9.8~ Critical | Improper Access Control, Code / Firmware Injection | — | 2023 |
| ICSA-MIT-0013 | Mitsubishi Electric MELSEC iQ-R series, MELSEC iQ-F series, MELSEC Q series | CVE-2021-20594 CVE-2020-5668 | 8.1~ High | Authentication Bypass, Denial of Service | — | 2021 |
| ICSA-OMR-0014 | Omron SYSMAC CJ series, SYSMAC CS series, NJ/NX controllers | CVE-2022-31204 CVE-2019-18269 | 9.4~ Critical | Missing Authentication, Improper Access Control | — | 2022 |
| ICSA-WAGO-0015 | WAGO PFC100 controller, PFC200 controller, Edge Controller | CVE-2022-45138 CVE-2019-5177 | 8.8~ High | Command Injection, Information Disclosure | — | 2022 |
| ICSA-PXM-0016 | Siemens Desigo PXC, APOGEE PXC, TALON | CVE-2022-24040 | 8.6~ High | Missing Authentication, Improper Access Control | — | 2022 |
| ICSA-TRI-0017 | Tridium (Honeywell) Niagara AX Framework, Niagara 4 (Fox/Foxs) | CVE-2017-16744 CVE-2012-4701 | 8.8~ High | Path Traversal, Information Disclosure | — | 2017 |
| ICSA-REF-0018 | Danfoss AK-SM 800 series system manager, AK-SC refrigeration controllers | CVE-2021-42543 | 7.6~ High | Hardcoded / Default Credentials, Improper Access Control | — | 2021 |
| ICSA-REF-0018B | Danfoss AK-SM 800 / 800A system managers, AK-SC refrigeration controllers | CVE-2025-41450 CVE-2025-41451 | 9.3~ Critical | Authentication Bypass, Command Injection | ● | 2026 |
| ICSA-JCI-0019 | Johnson Controls Metasys ADS/ADX, Metasys NAE/SNC | CVE-2023-4486 CVE-2021-36202 | 7.5~ High | Cross-site Scripting, Information Disclosure | — | 2023 |
| ICSA-SUB-0020 | SMA Solar Sunny WebBox, Cluster Controller | CVE-2017-9851 | 9.8~ Critical | Missing Authentication, Information Disclosure | ● | 2017 |
| ICSA-HID-0021 | HID Global VertX / Edge controllers, Mercury-based access panels | CVE-2022-31479 CVE-2022-31483 | 9.0~ Critical | Hardcoded / Default Credentials, Command Injection | — | 2022 |
| ICSA-PHX-0022 | Phoenix Contact PLCnext AXC F, mGuard security appliances | CVE-2022-3737 CVE-2021-34570 | 8.1~ High | Improper Access Control, Denial of Service | — | 2022 |
| ICSA-BEC-0023 | Beckhoff TwinCAT 3 runtime, ADS over TCP (48898) | CVE-2023-34197 CVE-2019-5636 | 7.5~ High | Missing Authentication, Denial of Service | — | 2023 |
| ICSA-YOK-0024 | Yokogawa CENTUM VP, Exaopc, ProSafe-RS | CVE-2019-5909 CVE-2014-0783 | 9.8~ Critical | Buffer Overflow, Code / Firmware Injection | — | 2019 |
| ICSA-PRO-0025 | CODESYS / 3S-Smart CODESYS Control Runtime, Many OEM PLCs embedding CODESYS | CVE-2022-31806 CVE-2021-30186 | 10.0~ Critical | Missing Authentication, Buffer Overflow | — | 2022 |
| ICSA-DNP-0026 | Multiple (Triangle MicroWorks et al.) DNP3 SCADA master software, RTU/outstation DNP3 stacks | CVE-2013-2811 CVE-2013-2823 | 7.5~ High | Denial of Service, Buffer Overflow | — | 2013 |
| ICSA-IEC-0027 | Multiple IEC 60870-5-104 RTUs and gateways | CVE-2020-13541 | 7.4~ High | Missing Authentication, Improper Access Control | — | 2020 |
| ICSA-HMI-0028 | Advantech WebAccess/SCADA, WebAccess/NMS | CVE-2019-3975 CVE-2018-15706 | 9.8~ Critical | Path Traversal, Command Injection | ● | 2019 |
| ICSA-HMI-0029 | AVEVA (Wonderware) InduSoft Web Studio, AVEVA Edge, Wonderware System Platform | CVE-2018-17916 CVE-2020-13497 | 9.8~ Critical | Buffer Overflow, Improper Access Control | — | 2020 |
| ICSA-HIS-0030 | Hitachi Energy MicroSCADA Pro/X SYS600, RTU500 series | CVE-2022-3703 CVE-2022-4608 | 8.6~ High | Authentication Bypass, Denial of Service | — | 2022 |
| ICSA-NET-0031 | Fortinet FortiOS SSL-VPN (used as OT remote-access gateway) | CVE-2018-13379 | 9.8 Critical | Path Traversal, Information Disclosure | ● | 2019 |
| ICSA-NET-0032 | Multiple (Hirschmann, Westermo et al.) Managed industrial Ethernet switches | CVE-2021-33534 | 7.5~ High | Hardcoded / Default Credentials, Improper Access Control | — | 2021 |
| ICSA-MED-0033 | Multiple Hospital BMS/HVAC controllers, Nurse-call and clinical IoT gateways | CVE-2021-27410 | 8.2~ High | Hardcoded / Default Credentials, Information Disclosure | — | 2021 |
| ICSA-WTR-0034 | Multiple (configuration class) Water/wastewater HMI workstations with remote-desktop tools | N/A (misconfiguration class) | 8.8~ High | Missing Authentication, Improper Access Control | ● | 2021 |
| ICSA-VPN-0035 | Multiple SSL-VPN / remote-access gateways fronting OT | CVE-2023-27997 | 9.8~ Critical | Buffer Overflow, Authentication Bypass | ● | 2023 |
| ICSA-PLC-0036 | Unitronics Vision series integrated PLC+HMI | N/A (default-credential class) | 9.1~ Critical | Hardcoded / Default Credentials, Missing Authentication | ● | 2023 |
| ICSA-RAIL-0037 | Multiple Wayside interlocking controllers, Rail SCADA gateways | CVE-2021-37160 | 8.1~ High | Missing Authentication, Improper Access Control | — | 2021 |
| ICSA-INV-0038 | Multiple Grid-tied inverter gateways with cloud control | CVE-2022-29303 | 9.8~ Critical | Command Injection, Authentication Bypass | — | 2022 |
| ICSA-PRN-0039 | Multiple PAC/PLC web configuration interfaces | CVE-2021-22779 | 6.5~ Medium | Cross-site Scripting, Improper Access Control | — | 2021 |
| ICSA-GAS-0040 | Multiple OT data historians, Pipeline SCADA reporting servers | CVE-2020-10602 | 8.5~ High | Command Injection, Information Disclosure | — | 2020 |
Methodology & scope
- Curated teaching dataset, not a live feed. These 41 advisories were hand-picked to be representative — spanning vendors, vulnerability classes and critical-infrastructure sectors — in the style of CISA ICS-CERT bulletins. They are not pulled from a real-time source and are not exhaustive.
- CVEs are real; scores are representative. CVE identifiers are genuine published CVEs. CVSS values are the published base scores (CVSS v3.x) where a single clear score exists; where an advisory covered several CVEs with a range, the highest representative base score is shown and marked approximate (~).
- A few entries are configuration classes. Some rows (for example internet-exposed remote access, or default-credential exposure) describe a widely-seen misconfiguration pattern rather than a single product CVE, and are marked "N/A" in the CVE column.
- Always verify before acting. This is an educational reference. Before any operational remediation decision, confirm against the official CISA advisory and the vendor's own security bulletin.
As of 14 October 2026. Dataset contents are static; this page renders them directly from PlayCISO's curated source.
Cite this: “ICS & OT Security Advisories — Curated Dataset,” PlayCISO, 14 October 2026. https://playciso.com/guides/ics-ot-advisories
Frequently asked questions
Is this a live feed of CISA ICS-CERT advisories?
No. This is a curated teaching sample of 41 representative ICS/OT advisories, hand-picked in the style of CISA ICS-CERT bulletins to span vendors, vulnerability classes and critical-infrastructure sectors. It is a static dataset, not a real-time feed. Always verify against the official CISA advisory and the vendor's own bulletin before acting operationally.
Are the CVE identifiers and CVSS scores real?
The CVE identifiers are real, published CVEs. CVSS values are the published base scores (CVSS v3.x) where a single clear score exists; where an advisory spanned several CVEs with a range, the highest representative base score is given and flagged as approximate. A handful of entries describe a misconfiguration class (for example internet-exposed remote access) rather than a single product CVE and are marked "N/A".
What does "exploited in the wild" mean here?
It flags advisories whose underlying flaw or exposure class has publicly documented real-world exploitation — for example TRITON/TRISIS against a safety system, actively scanned SCADA software, or internet-exposed controllers with default passwords. 8 of the 41 entries carry this flag.
Which vendors and sectors are covered?
The dataset spans 29 vendors — including Siemens, Schneider Electric, Rockwell Automation, Honeywell, Mitsubishi Electric, Omron, ABB, Emerson and others — across 11 sectors such as Energy, Water & Wastewater, Critical Manufacturing, Building Automation, Chemical, Transportation and Healthcare. Advisories range from 2013 to 2026.
Can I use this dataset to train or teach?
Yes — that is its purpose. It powers PlayCISO's interactive ICS Advisory Explorer and OT security hub, and you are free to cite it for education. It is not a substitute for an operational vulnerability-management feed; pair it with the authoritative CISA and vendor sources before making remediation decisions.