CISA Publishes 13 ICS Security Advisories on Critical Flaws

The Cybersecurity and Infrastructure Security Agency (CISA) released thirteen Industrial Control Systems (ICS) security advisories on July 17, 2025, highlighting critical vulnerabilities that could compromise essential infrastructure operations.

This coordinated disclosure represents one of the most significant advisory releases of the year, underscoring escalating threats to operational technology networks across multiple sectors.

Three Priority Vulnerabilities Demand Immediate Action

Among the latest disclosures, three advisories require urgent attention from system administrators.

ICSA-25-198-01 exposes vulnerabilities in Leviton’s AcquiSuite and Energy Monitoring Hub, where inadequate input validation could allow unauthenticated attackers to craft malicious requests capable of triggering device resets or service disruptions.

The advisory warns that exploitation requires minimal technical skill and could affect energy management systems across commercial and industrial facilities.

ICSMA-25-198-01 reveals authentication flaws in Panoramic Corporation’s Digital Imaging Software, potentially permitting unauthorized users to view or manipulate sensitive diagnostic imagery.

This vulnerability particularly concerns healthcare and industrial diagnostic environments where image integrity is critical for operational decisions.

The third critical advisory, ICSA-24-191-05 Update B, revisits Johnson Controls’ Software House C●CURE 9000 system, identifying a buffer overflow condition that could enable arbitrary code execution under service account privileges.

Given the widespread deployment of this access control platform in commercial buildings and secure facilities, successful exploitation could compromise physical security systems.

The remaining ten advisories encompass vulnerabilities affecting programmable logic controllers, human-machine interfaces, and supervisory control systems from multiple vendors.

These flaws include authentication bypass mechanisms, command injection vulnerabilities, directory traversal exploits, and cross-site scripting attacks that could enable unauthorized system access or manipulation.

The affected systems span critical infrastructure sectors including electric power generation, water treatment facilities, manufacturing operations, transportation networks, and healthcare systems.

CISA emphasizes that these vulnerabilities could allow threat actors to disrupt essential services, potentially endangering public safety and economic stability.

CISA strongly recommends that organizations immediately apply vendor-issued patches and firmware updates.

Where immediate patching is not feasible, the agency advises implementing compensating controls including network segmentation, enhanced monitoring, and restricted remote access capabilities.

System operators should prioritize disabling unnecessary services, enforcing multi-factor authentication for privileged accounts, and isolating operational technology networks from enterprise IT environments.

The agency also recommends continuous monitoring for anomalous network activity and implementing robust backup and recovery procedures.

Organizations are urged to review the complete set of advisories available on CISA’s website for detailed technical specifications and vendor-specific mitigation guidance.

Given the critical nature of these vulnerabilities and their potential for exploitation, immediate action is essential to prevent disruption of essential infrastructure services.

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now