ICSA-RCK-0006 9.8~ Critical
Rockwell Automation FactoryTalk — unauthenticated services access Improper input validation in FactoryTalk components allowed a remote attacker to run arbitrary code on the HMI/SCADA server by sending crafted messages.
Missing Authentication Command Injection Rockwell Automation 2023
ICSA-HON-0012 9.8~ Critical
Honeywell Experion PKS — remote code execution in control data access Flaws in the Control Data Access and server components allowed an attacker to execute code or alter controller files, risking unsafe process states.
Improper Access Control Code / Firmware Injection Honeywell 2023
OT remote-access appliance — authentication bypass (ransomware vector) A heap overflow in a widely-deployed VPN appliance enabled pre-auth remote code execution — the kind of perimeter flaw repeatedly used as the entry point for OT-disrupting ransomware.
Buffer Overflow Authentication Bypass Multiple 2023
Unitronics Vision PLC/HMI — default password & internet exposure Internet-exposed integrated PLC/HMIs with the factory default password were defaced and disrupted at water utilities — a reminder that default creds plus exposure is as damaging as any CVE.
Hardcoded / Default Credentials Missing Authentication Unitronics 2023
Johnson Controls Metasys — stored XSS & information disclosure (BMS) Web-UI flaws in the building-automation supervisor could leak sensitive data and run script in an operator session, aiding takeover of the BMS.
Cross-site Scripting Information Disclosure Johnson Controls 2023
Beckhoff TwinCAT / ADS — unauthenticated ADS routing access The ADS routing/transport used by TwinCAT allowed unauthenticated hosts to interact with the runtime and, in some cases, crash it, affecting PC-based control.
Missing Authentication Denial of Service Beckhoff 2023
ICSA-PRO-0025 10.0~ Critical
ProConOS / CoDeSys runtime — unauthenticated program upload (multi-vendor) The widely-OEM-embedded CODESYS runtime allowed unauthenticated program download and had memory-safety flaws, so one class of bug affects PLCs from dozens of brands.
Missing Authentication Buffer Overflow CODESYS / 3S-Smart 2022
ICSA-INV-0038 9.8~ Critical
Solar/battery inverter cloud-gateway — API auth bypass Cloud-connected inverter gateways had command-injection and auth-bypass flaws; at fleet scale, manipulation of distributed energy resources has grid-stability implications.
Command Injection Authentication Bypass Multiple 2022
ICSA-OMR-0014 9.4~ Critical
Omron SYSMAC / CJ / CS — no authentication on FINS protocol The FINS protocol used to program and control Omron PLCs lacks authentication, so any host that can reach UDP/TCP 9600 can read memory, change modes and overwrite logic.
Missing Authentication Improper Access Control Omron 2022
ICSA-EMR-0010 9.1~ Critical
Emerson OpenBSI / ControlWave — hardcoded credentials in RTU toolchain Remote terminal units used in oil & gas and water telemetry exposed engineering access without strong authentication, letting a network attacker read or alter field logic.
Hardcoded / Default Credentials Missing Authentication Emerson 2022
ICSA-HID-0021 9.0~ Critical
HID / access-control panel — default credentials & command execution Physical-access-control panels were reachable with default credentials and vulnerable to command injection, letting an attacker unlock doors and tamper with access logs.
Hardcoded / Default Credentials Command Injection HID Global 2022
WAGO PFC100/PFC200 — web-based management command injection The controller web-based management (WBM) exposed parameters that allowed command injection and disclosure of configuration, giving a network attacker control of the device.
Command Injection Information Disclosure WAGO 2022
Siemens Desigo / APOGEE PXC (BMS) — unauthenticated BACnet device control Building-management controllers accepted BACnet/IP writes without authentication, letting an attacker on the BMS network change setpoints for HVAC, access control and life-safety subsystems.
Missing Authentication Improper Access Control Siemens 2022
Hitachi Energy MicroSCADA / RTU500 — improper authentication Authentication and input-validation flaws in substation SCADA/RTU products could let an attacker bypass controls or disrupt grid telemetry and control.
Authentication Bypass Denial of Service Hitachi Energy 2022
Phoenix Contact PLCnext / mGuard — privilege escalation Access-control and resource-handling flaws allowed a local or network attacker to escalate privilege or disrupt the controller and the industrial security appliance.
Improper Access Control Denial of Service Phoenix Contact 2022
GE Digital Proficy / iFIX — improper access control in HMI/SCADA Weak file-permission and path-handling defaults in the HMI/SCADA runtime allowed a local attacker to escalate privilege and tamper with project files.
Improper Access Control Path Traversal GE Digital 2022
ICSA-RCK-0005 10.0 Critical
Rockwell Automation ControlLogix / CompactLogix — remote denial of service A hardcoded cryptographic key in Studio 5000 Logix Designer let a remote attacker bypass the controller verification mechanism and connect to the PLC, modifying its configuration and logic.
Authentication Bypass Cryptographic Weakness Rockwell Automation 2021
Moxa EDR / industrial routers — web management authentication bypass Flaws in the router web console allowed session/authentication bypass and stored XSS, giving an attacker on the management network administrative control of the perimeter device.
Authentication Bypass Cross-site Scripting Moxa 2021
Water-utility HMI remote access — weak/shared VNC & TeamViewer The Oldsmar-style incident class: an operator HMI reachable over internet-exposed remote-desktop software with a shared password, letting an intruder move a chemical setpoint. Not a product CVE — a remote-access configuration failure.
Missing Authentication Improper Access Control Multiple (configuration class) 2021
Medical device gateway / BMS crossover — hardcoded credentials Controllers managing hospital environment and clinical-support systems shipped with fixed credentials, putting patient-care infrastructure on the same risk footing as industrial BMS.
Hardcoded / Default Credentials Information Disclosure Multiple 2021
Siemens SIMATIC S7-1200/S7-1500 — authentication bypass in legacy TIA access A memory-protection bypass let a remote, unauthenticated attacker write arbitrary data and code to protected memory regions, or read sensitive data, enabling native code execution on the PLC.
Improper Access Control Authentication Bypass Siemens 2021
Mitsubishi Electric MELSEC — authentication brute force & DoS Block-cipher and lockout weaknesses in the MELSEC authentication, plus a resource-exhaustion flaw, let an attacker guess credentials or stop the PLC from responding.
Authentication Bypass Denial of Service Mitsubishi Electric 2021
Rail signalling / wayside controller — unauthenticated protocol access Transport-sector controllers exposed control interfaces without authentication over the operational network, a safety-critical exposure for signalling and wayside systems.
Missing Authentication Improper Access Control Multiple 2021
Industrial refrigeration controller — hardcoded web credentials Supermarket and cold-chain refrigeration system managers shipped with fixed web credentials, allowing anyone who reached the web UI to change cooling setpoints and alarms.
Hardcoded / Default Credentials Improper Access Control Danfoss 2021
ABB 800xA / Symphony — SCADA process DoS via malformed packet A malformed message to the DCS communication service caused the process-control node to crash, interrupting monitoring and control of the plant.
Denial of Service Buffer Overflow ABB 2021
Industrial switch SNMP — default community strings & write access Industrial switches left SNMP enabled with default public/private community strings and SNMP write, letting an attacker reconfigure VLANs and port mirroring to pivot across OT segments.
Hardcoded / Default Credentials Improper Access Control Multiple (Hirschmann, Westermo et al.) 2021
Programmable automation controller — web UI stored XSS & CSRF Stored XSS and CSRF in controller web UIs let an attacker run actions in an engineer’s authenticated session, a stepping stone to configuration change.
Cross-site Scripting Improper Access Control Multiple 2021
ICSA-MOX-0007 9.8~ Critical
Moxa NPort / serial device servers — default credentials & command injection Serial-to-Ethernet gateways shipped with default/weak credentials and a stack overflow in the firmware service, allowing remote takeover of the device that bridges legacy serial field equipment to the network.
Hardcoded / Default Credentials Buffer Overflow Moxa 2020
ICSA-HMI-0029 9.8~ Critical
InduSoft / Wonderware (AVEVA) Edge — stack overflow RCE The HMI/SCADA runtime service was vulnerable to a remotely-triggered stack overflow, letting an attacker run code on the operator-facing server.
Buffer Overflow Improper Access Control AVEVA (Wonderware) 2020
Pipeline / gas SCADA historian — SQL injection & info disclosure Historian/reporting servers bridging OT and IT had injection flaws exposing process data and, in some cases, a path deeper into the control network.
Command Injection Information Disclosure Multiple 2020
Schneider Electric Modicon M221 — weak protocol authentication & replay Weak password hashing and a replayable application-protection mechanism allowed an attacker on the Modbus network to recover the project password and overwrite controller logic.
Cryptographic Weakness Authentication Bypass Schneider Electric 2020
IEC 60870-5-104 telecontrol — spoofed command injection IEC-104, the European telecontrol standard, has no built-in authentication, so an attacker on the WAN link can inject control commands to breakers and switches.
Missing Authentication Improper Access Control Multiple 2020
ICSA-YOK-0024 9.8~ Critical
Yokogawa CENTUM / Exaopc — buffer overflow in DCS communication Stack overflows in DCS communication services allowed remote code execution on process-control and safety nodes, including the safety instrumented system.
Buffer Overflow Code / Firmware Injection Yokogawa 2019
Advantech WebAccess SCADA — path traversal & SQL injection Multiple remotely-exploitable flaws in this browser-based SCADA have appeared in exploit kits and botnet scanning, allowing remote code execution on the SCADA server.
Path Traversal Command Injection Advantech 2019
Fortinet / SSL-VPN at the OT perimeter — pre-auth path traversal A pre-authentication path-traversal in the SSL-VPN leaked session files and credentials; repeatedly used to breach networks, including the remote-access path into OT environments.
Path Traversal Information Disclosure Fortinet 2019
ICSA-SIM-0002 9.1 Critical
Siemens SIMATIC PCS 7 / WinCC — hardcoded database credentials An authenticated attacker with network access to the DCS/SCADA server could use embedded credentials to execute arbitrary commands with SYSTEM privileges.
Hardcoded / Default Credentials Improper Access Control Siemens 2019
Schneider Electric Triconex Tricon (TRITON/TRISIS) — safety controller compromise Malware (TRITON/TRISIS) targeted the Triconex Safety Instrumented System, delivering a payload to the controller to manipulate the safety logic. One of the first publicly known attacks aimed directly at a safety system.
Improper Access Control Code / Firmware Injection Schneider Electric 2018
Sunny WebBox / solar inverter gateway — no authentication on control Internet-exposed PV plant gateways exposed control and configuration without authentication; thousands were found reachable, allowing remote manipulation of distributed solar generation.
Missing Authentication Information Disclosure SMA Solar 2017
Tridium Niagara Framework — directory traversal & credential exposure Path-traversal and weak credential storage in the Niagara station let an attacker reach the config file and recover platform credentials for the building-automation controller.
Path Traversal Information Disclosure Tridium (Honeywell) 2017
DNP3 master/outstation stacks — malformed-frame denial of service A series of fuzzing-discovered flaws across many DNP3 implementations let a malformed frame on a serial or TCP link crash the master or outstation, disrupting SCADA polling.
Denial of Service Buffer Overflow Multiple (Triangle MicroWorks et al.) 2013