The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published five ICS (industrial control systems) advisories on Thursday, flagging critical vulnerabilities affecting operational technology products widely deployed across critical infrastructure. The advisories cover Honeywell’s OneWireless Wireless Device Manager, Mitsubishi Electric’s Iconics Digital Solutions, Delta Electronics’ COMMGR, Honeywell’s Experion PKS, and the End-of-Train and Head-of-Train Remote Linking Protocol used in the rail sector.
In its first advisory, CISA detailed vulnerabilities in Mitsubishi Electric’s Iconics Digital Solutions portfolio. The agency catalogued several memory and handler-related vulnerabilities ranging from uninitialized variables to improper restriction of operations within the bounds of a memory buffer, sensitive information in a resource not removed before reuse, integer underflow (wrap or wraparound), and deployment of the wrong handler.
It added that “Successful exploitation of these vulnerabilities could result in information exposure, denial of service, or remote code execution.”
Deployed in the global chemical and energy sectors, the advisory highlighted that these hardware vulnerabilities affect OneWireless WDM in all releases before R322.5, as well as all releases before R331.1. Demid Uzenkov and Kirill Kutaev of Positive Technologies reported these vulnerabilities to Honeywell.
The Honeywell OneWireless WDM contains a memory buffer vulnerability in the Control Data Access (CDA) component. An attacker could potentially exploit this vulnerability, leading to a buffer overflow, which could result in improper index validation against buffer boundaries, potentially allowing for remote code execution. CVE-2025-2521 has been assigned to this vulnerability, with a CVSS v3.1 base score of 8.6 and a CVSS v4 base score of 8.5.
The Honeywell OneWireless WDM contains a sensitive information in a resource vulnerability in the Control Data Access (CDA) component. An attacker could potentially exploit this vulnerability, leading to a communication channel manipulation, which could result in buffer reuse, which may cause incorrect system behavior. CVE-2025-2522 has been assigned to this vulnerability, with a CVSS v3.1 base score of 6.5 and a CVSS v4 base score of 6.9.
The Honeywell OneWireless WDM contains an integer underflow vulnerability in the Control Data Access (CDA) component. An attacker could potentially exploit this vulnerability, leading to a communication channel manipulation, which could fail subtraction, allowing remote code execution. CVE-2025-2523 has been assigned to this vulnerability, with a CVSS v3.1 base score of 9.4 and a CVSS v4 base score of 8.8.
The Honeywell OneWireless WDM contains a deployment of a wrong handler vulnerability in the Control Data Access (CDA) component. An attacker could potentially exploit this vulnerability, leading to input data manipulation, which could result in incorrect packet handling, leading to remote code execution. CVE-2025-3946 has been assigned to this vulnerability, with a CVSS v3.1 base score of 8.2 and a CVSS v4 base score of 8.8.
CISA detailed that Mitsubishi Electric’s Iconics Digital Solutions portfolio contained a Windows Shortcut Following (.LNK) vulnerability. The affected products include all versions of GENESIS64, version 11.00 of GENESIS, and all versions of Mitsubishi Electric MC Works64. “Successful exploitation of this vulnerability could result in information tampering.”
Deployed across the critical manufacturing sector, CISA identified that an information tampering vulnerability due to Windows Shortcut Following exists in multiple processes in GENESIS64, MC Works64, and GENESIS. A local attacker needs low privileges to exploit this vulnerability. By creating a symbolic link, an attacker can cause the processes to make unauthorized writes to arbitrary files on the file system in any location that is accessible to the user under which the elevated processes are running, resulting in a denial-of-service (DoS) condition on the PC if the modified file is necessary for the operation of the PC.
CVE-2025-7376 has been assigned to this vulnerability, with a CVSS v3.1 base score of 5.9 and a CVSS v4 base score of 4.1. Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric reported this vulnerability to CISA.
Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric recommend that users upgrade to GENESIS version 11.01, which contains a fix for the vulnerability. For the highest level of security, users should upgrade their systems to the most recent release and ensure they remain current with all future updates. The vendors advise customers to consult Mitsubishi Electric Iconics Digital Solutions Support for assistance with the upgrade process.
For users who remain on affected versions, the companies caution that this information tampering vulnerability poses ongoing risk. Systems should be configured so that only administrators can log in, and workstations with the affected product installed should block remote logins from untrusted networks, unverified hosts, and non-administrator users.
Access should be controlled by a firewall or virtual private network, with remote logins restricted solely to administrators when systems are connected to the internet. Physical access to the workstation and the associated network should also be restricted to prevent unauthorized entry. In addition, users should avoid clicking on links in unsolicited emails and refrain from opening attachments from untrusted sources.
Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric said they are preparing a future version of GENESIS64 that will include additional countermeasures against this vulnerability. In the meantime, users are advised to update the ICONICS Suite with the latest security patches as they become available. Security updates for the ICONICS Suite can be accessed through the vendor’s support portal.
Delta Electronics’ COMMGR software management platform was the focus of the third advisory, as it contained the ‘use of a cryptographically weak Pseudo-Random Number Generator (PRNG)’ vulnerability. The affected products include all versions of COMMGR version 1, as well as version 2.9.0 and earlier versions of COMMGR version 2. “Successful exploitation of this vulnerability could allow for an attacker to remotely access the AS3000Simulator family in the COMMGR software and execute arbitrary code.”
Used across the global commercial facilities, communications, critical manufacturing, energy, healthcare and public health sectors, CISA noted that the software uses insufficiently randomized values to generate session IDs. An attacker could easily brute force a session ID and load and execute arbitrary code. CVE-2025-3495 has been assigned to this vulnerability, with a CVSS v3.1 base score of 9.8 and a CVSS v4 base score of 9.3.
Trend Micro’s Zero Day Initiative (ZDI) reported this vulnerability to CISA. COMMGR software Version 1 has reached end of life (EOL).
Delta Electronics recommends that users of COMMGR software version 1 minimize network exposure for all control system devices and software, ensuring they are not accessible from the internet. When remote access is required, the company advises using secure methods such as virtual private networks. Control system networks and remote devices should be placed behind firewalls and kept isolated from the business network. Programming software should never be connected to any network other than the one specifically intended for that device.
Delta Electronics has released COMMGR v2.10.0.
In another advisory, CISA detailed the presence of use of uninitialized variables, improper restriction of operations within the bounds of a memory buffer, sensitive information in a resource not removed before reuse, integer underflow (wrap or wraparound), and deployment of wrong handler vulnerabilities in Honeywell’s Experion PKS equipment. “Successful exploitation of these vulnerabilities could result in information exposure, denial of service, or remote code execution.”
Deployed across the global chemical, critical manufacturing, energy, healthcare and public health, and water and wastewater systems sectors, Demid Uzenkov and Kirill Kutaev of Positive Technologies reported these vulnerabilities to Honeywell.
The most severe, CVE-2025-2523, was scored at 9.4 under CVSS v3.1. Honeywell recommends updating Experion PKS R520.2 TCU9 Hot Fix 1 or R530 TCU3 Hot Fix 1, and operators are advised to apply them immediately. Until patches are deployed, network isolation, strict access controls, and strong firewall policies remain critical mitigations.
The final advisory focused on the End-of-Train and Head-of-Train Remote Linking Protocol, which is widely used in rail operations. The update expands on previously disclosed weaknesses in how the protocol relies on a basic checksum to validate communication. Attackers able to craft malicious radio packets could potentially mimic legitimate brake-control messages, leading to degraded safety communications or operational disruption within rail networks.
Known affected vendors include Wabtec, Siemens, and DPS Electronics. CISA noted that while there are no confirmed exploitation attempts for these specific vulnerabilities at this time, threat actors continue to probe industrial systems for weaknesses actively. The agency stressed that asset owners and operators should treat these advisories as urgent, applying vendor patches where available and implementing network segmentation, least privilege access, and continuous monitoring to detect anomalous behavior.
All versions of the End-of-Train and Head-of-Train remote linking protocol are affected. The manufacturers have also confirmed that specific devices are impacted, including the Wabtec TrainLink NG End of Train (NGEOT), the Wabtec TrainLink NG3 ATX End of Train (NG3 EOT), the Wabtec TrainLink NG4 ATX End of Train (NG4 EOT), and the Wabtec TrainLink NG5 ATX End of Train (NG5 EOT).
Deployed across transportation systems, CISA identified that the protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software defined radio and issue brake control commands to the EoT device, disrupting operations or potentially overwhelming the brake systems. CVE-2025-1727 has been assigned to this vulnerability. It carries a CVSS v3 base score of 8.1, while the CVSS v4 calculation gives it a base score of 7.2.
Neil Smith and Eric Reuter reported this vulnerability to CISA. The Association of American Railroads (AAR) is pursuing new equipment and protocols that should replace traditional End-of-Train and Head-of-Train devices. The standards committees involved in these updates are aware of the vulnerability and are investigating mitigating solutions. The AAR Railroad Electronics Standards Committee (RESC) maintains this protocol, which is used by multiple manufacturers across the industry.
Users of EoT/HoT devices are recommended to contact their own device manufacturers with questions. Wabtec directs users to visit their cybersecurity page for additional information.
