The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday issued two new industrial control systems (ICS) advisories and updated a previous one, detailing vulnerabilities affecting INVT VT-Designer and HMITool, Schneider Electric Modicon M340 modules, and Danfoss AK-SM 8xxA Series devices. The advisories provide timely information on vulnerabilities, exploits, and other security risks affecting ICS infrastructure, and the agency called upon critical infrastructure asset owners and operators to review the technical details and recommended mitigations.
In an advisory, CISA disclosed that INVT VT-Designer and HMITool equipment contained out-of-bounds write and access of resource using incompatible type (‘type confusion’) vulnerabilities. Deployed globally across the commercial facilities, critical manufacturing, energy, IT and transportation systems sectors, the advisory identified that “successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code in the context of the current process.”
The affected products include INVT VT-Designer version 2.1.13, which is linked to CVE-2025-7227, CVE-2025-7228, CVE-2025-7229, CVE-2025-7230, and CVE-2025-7231. HMITool version 7.1.011 is also impacted, associated with CVE-2025-7223, CVE-2025-7224, CVE-2025-7225, and CVE-2025-7226.
The HMITool is vulnerable to remote attackers who can execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in writing past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
HMITool is vulnerable to remote attackers who can execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in writing past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
The advisory added that the HMITool is vulnerable to remote attackers who can execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in writing past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
HMITool is vulnerable to remote attackers who can execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in writing past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
VT-Designer is vulnerable to remote attackers who can execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in writing past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.
VT-Designer is vulnerable to remote attackers who can execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in writing past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.
VT-Designer is vulnerable to remote attackers who can execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in writing past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVE-2025-7223 through CVE-2025-7231 have been assigned to the vulnerabilities affecting INVT VT-Designer and HMITool. Each of these vulnerabilities has been rated with a CVSS v3.1 base score of 7.8. Under the updated CVSS v4 framework, the base score for each increases to 8.5, reflecting a higher level of severity.
Kimiya, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA.
INVT did not respond to CISA’s attempt to coordinate these vulnerabilities. Users should contact the Chinese vendor for more information.
In another advisory, CISA disclosed an improper input validation vulnerability affecting Schneider Electric Modicon M340 and associated communication modules. “Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.”
The advisory mentioned that all versions of the Modicon M340, the BMXNOR0200H Ethernet/Serial RTU module, the BMXNGD0100 M580 Global Data module, and the BMXNOC0401 Modicon M340 X80 Ethernet communication modules are affected. In addition, the BMXNOE0100 Modbus/TCP Ethernet Modicon M340 module is affected in versions before 3.60, and the BMXNOE0110 Modbus/TCP Ethernet Modicon M340 FactoryCast module is affected in versions before 6.80. The vulnerability affects the global critical manufacturing and energy sectors.
An improper input validation vulnerability exists that could cause a Denial-of-Service when a specially crafted FTP command is sent to the device. CVE-2025-6625 has been assigned to this vulnerability. It has a CVSS v3.1 base score of 7.5, while under CVSS v4 the base score is 8.7.
CyManII reported this vulnerability to Schneider Electric.
Schneider Electric has identified specific workarounds and mitigations that users can apply to reduce risk. Version 3.60 of the BMXNOE0100 Modbus/TCP Ethernet Modicon M340 module includes a fix for this vulnerability and is available for download, though a reboot is required to complete the firmware upgrade. Similarly, version 6.80 of the BMXNOE0110 Modbus/TCP Ethernet Modicon M340 FactoryCast module provides a fix that is also available for download, with a reboot required to finalize the update. Schneider Electric is also establishing a remediation plan for all future versions of the Modicon M340, BMXNOR0200H, BMXNGD0100, and BMXNOC401.
In the meantime, the company advises users to apply additional mitigations, including disabling the FTP service when not in use, maintaining proper network segmentation, implementing firewalls to block unauthorized access to port 21/FTP, and using VPN tunnels when remote access is required.
In another advisory, CISA identified that the Danfoss AK-SM 8xxA Series contained improper authentication, command injection, and external control of system or configuration setting vulnerabilities. “Successful exploitation of these vulnerabilities could enable a remote attacker to bypass authentication and remotely execute arbitrary code.”
The affected products include the AK-SM 8xxA Series, with versions before R4.2 impacted by CVE-2025-41450. In addition, versions before 4.3.1 are affected by CVE-2025-41451 and CVE-2025-41452.
An unauthorized access vulnerability, caused by datetime-based password generation, could potentially result in an authentication bypass in Danfoss AK-SM8xxA Series, before version R4.2. CVE-2025-41450 has been assigned to this vulnerability. It carries a CVSS v3.1 base score of 8.2, while under CVSS v4 the base score is 7.3.
Improper neutralization of alarm-to-mail configuration fields used in an OS shell command injection in Danfoss AK-SM8xxA Series, before version 4.3.1, may lead to post-authenticated remote code execution on an attacked system. CVE-2025-41451 has been assigned to this vulnerability. It has a CVSS v3.1 base score of 7.6, and under CVSS v4, the base score is 8.7.
A post-authenticated external control of system web interface configuration setting vulnerability exists in the Danfoss AK-SM8xxA Series before version 4.3.1, which could allow for a denial-of-service attack induced by improper handling of exceptional conditions. CVE-2025-41452 has been assigned to this vulnerability. It has a CVSS v3.1 base score of 5.4, while under CVSS v4 the base score is 6.8.
Tomer Goldschmidt of Claroty Team82 reported these vulnerabilities to CISA.
Danfoss released version R4.2 to address CVE-2025-41450 and version R4.3.1 to address CVE-2025-41451 and CVE-2025-41452. Users can obtain and install the updates by following the AK-SM 800A software upgrade process.
