Tech News 2025 | AI Innovations, Product Launches & Trends

Home
CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount disruptive cyberattacks. These threats target vulnerable operational technology (OT) and legacy components, often exploiting weak authentication and edge devices.

Key vulnerabilities and Risks
- Targeted infrastructure: increased cyber threats target renewable energy systems, such as solar and wind installations, and electricity grid management devices that help operate and monitor the power grid.
- Prepositioning attacks—such as Chinese state‑sponsored access (e.g., Volt Typhoon)—have compromised IT networks to enable future disciples.
- About 75% of transmission lines are over 25 years old. These systems often run unsupported software and lack modern security.
- Common attack vectors: attackers exploit weak passwords, a lack of multifactor authentication (MFA), and internet-facing OT devices.
- Specific threats, column, malware capabilities, inflow, targeting remote units (RTUs), and breaking industrial control system (ICS) protocols to degrade reliability
Mitigation And Actionable Advice

CISA encourages organizations to take immediate action:
- Enhance authentication: implement strict MFA, and eliminate default credentials.
- Ensure control systems are not directly accessible from the internet. Remove unnecessary network exposure.
- Monitoring column: Implement continuous monitoring programs to detect anomalies as highlighted on the CISA ICS web page.
- Review advisories: organizations should review specific advisories, such as the Superpower Sun Power PVS 6 device vulnerability (CVE 2025-9696).
The US Cybersecurity and Infrastructure Security Agency (CISA) published four new advisories on industrial control systems on Tuesday. These advisories detail vulnerabilities in equipment from Delta Electronics, Fuji Electric, Sun Power, and Hitachi Energy. The agency said these advisories provide essential technical information and mitigation guidance for asset owners and operators across the critical infrastructure sector.

The advisory covering Delta Electronics points to an improper restriction of XML external entity reference vulnerability in the company's EIP Builder, an engineering tool used to build and manage Ethernet/IP networks. Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in the disclosure of sensitive information.

Deployed in the global critical manufacturing sector, CISA noted that the affected product is vulnerable to an XML external entity vulnerability, which could allow an attacker to disclose sensitive information. The vulnerability is tracked as CSCVE 2025.577704. It carries a CVSS v3.1 base score of 5.5. The updated CVSS v4 rating is 6.7.

KIMIYA, together with the Trend Micro Zero Day Initiative, reported this vulnerability to CISA. Delta Electronics recommends users update to V1.12 CISA 1. Attackers with network access could exploit the flaw to change configurations or disrupt operations. The company urges operators to apply security updates and recommended hardening steps.

A second advisory highlighted vulnerabilities in Fuji Electric’s FRENIC Loader 4 software, which is used with the company’s variable frequency drives. The flaws could allow arbitrary code execution or unauthorized system access, potentially enabling control hijacking or the forced shutdown of industrial processes. Fuji Electric’s FRE NIC Loader 4 is affected in versions earlier than 1.4.0.1.

Deployed across commercial facilities, the advisory identified that the affected product is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-969365. It has a CVSS v3.1 base score of 7.8, and in CVSS v4, the score rises to 8.4.

Kimiya also reported this vulnerability to CISA. Fuji Electric recommends users update to V1.1.4.0.1. CISA also disclosed weaknesses in SunPower's PVS6 device. The device aggregates data from photovoltaic systems and sends it to monitoring platforms. According to CISA, the flaws could compromise visibility into solar assets. They may also allow broader disruption across renewable energy environments.

The advisory added that successful exploitation of this vulnerability could allow attackers full access to the device, enabling them to replace firmware (the device's permanent software), modify settings, disable the device, create secure shell (SSH) tunnels for remote access, and manipulate attached devices.

The SunPower PVS 6's Bluetooth Low Energy (LE) SAR interface is vulnerable due to its use of hard-coded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows actions such as replacing the firmware (the permanent controlling software), disabling power production, changing grid settings, creating SSH (secure shell) tunnels for remote access, altering firewall settings, and manipulating connected devices. The vulnerability is tracked as CVE-2025-9696. It has a CVSS (Common Vulnerability Scoring System) v3.1 base score of 9.6, while the CVSS v4 score is 9.4.

Deployed across the global energy sector, Dagan and Henderson reported this vulnerability to CISA. However, SunPower did not respond to two CISS attempts to coordinate on these vulnerabilities. The last CISA ICS advisory updates a previous notice on Hitachi Energy’s Real Relion 670 and 650 series protection relays and SAM 600 IO modules. These systems are crucial for substation operations and high-voltage grid protection. The updated advisory gives more technical information and new mitigation strategies for power-sector operators.tors.

Hitachi Energy confirmed that multiple product lines are affected. The Relion 650 is impacted in versions 2.2.4.4 and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.6.2. The Relion 672 is affected in versions 2.2.2.6, 2.2.3.7, 2.2.4.4, and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.2.6.2. Additionally, the SAM 600 IO is vulnerable in version 2.2.5.6.

Deployed across the energy sector, CISA identified a denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanisms in the Relion 670/650 and SAM 600 I/O series devices, which, if exploited, could cause critical functions, such as the LDC (line distance communication module), to malfunction. The vulnerability is tracked as CVE-2025-2403. It has a CVSS v3.1 base score of 7.5, while the CVSS v4 score is 8.7.

Hitar G Energy PSIRT reported this vulnerability to CISA. Hitachi Energy outlined several specific workarounds and motivations to reduce risk for the Relion 670 series, version 2.2.6 revisions up to 2.2.6.2, and the Relion 650 series, version 2.2.6 revisions up to 2.2.6.2. The issue has been fixed in version 2.2.6.3, and users are advised to update to version 2.2.6.4 or later.

For the Relion 670 series version 2.2.5.6, the Relion 650 series version 2.2.5.6, and the SAM 600 IO series version 2.2.5.6, the flaw has been resolved in version 2.2.5.7, with updates recommended to version 2.2.5.8 or later. For the Relion 670 series (version 2.2.4.4) and the Relion 650 series (version 2.2.4), users should update to version 2.2.4.5 or later for all affected products. Hitachi Energy also recommends applying the general mitigation measures provided.

CISA encouraged asset owners, administrators, and security teams to review the advisories in full, apply vendor-issued patches, and adopt layered defense measures to safeguard against potential exploitation. While the agency said it has not observed active exploitation of the vulnerabilities, it emphasized that attackers continue to target operational technology systems in ongoing campaigns against critical infrastructure.

The latest advisories reflect a persistent trend of recurring security flaws across the industrial technology ecosystem. In operational technology, these updates are a reminder that vulnerabilities persist and that patching challenges, legacy systems, and operational risks must be factored into defense strategies.

Just last week, CISA released nine ICS advisories addressing cybersecurity vulnerabilities and risks for asset owners and operators across the critical infrastructure sector. The advisories cover urgent vulnerabilities in hardware and software, including CPU modules from Mitsubishi Electric, remote terminal units from Schneider Electric, CNC tools and communications from Delta Electronics, SCADA (supervisory control and data acquisition) platforms from GE Vernova, and various Mitsubishi FA tools and protection relay systems from Hitachi Energy.

Source: CISA advisories detail ICS flaws in Delta, Fuji Electric, SunPower, Hitachi Energy hardware; provide mitigation
About US
CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount disruptive cyberattacks. These threats target vulnerable operational technology (OT) and legacy components, often exploiting weak authentication and edge devices.

Key vulnerabilities and Risks
- Targeted infrastructure: increased cyber threats target renewable energy systems, such as solar and wind installations, and electricity grid management devices that help operate and monitor the power grid.
- Prepositioning attacks—such as Chinese state‑sponsored access (e.g., Volt Typhoon)—have compromised IT networks to enable future disciples.
- About 75% of transmission lines are over 25 years old. These systems often run unsupported software and lack modern security.
- Common attack vectors: attackers exploit weak passwords, a lack of multifactor authentication (MFA), and internet-facing OT devices.
- Specific threats, column, malware capabilities, inflow, targeting remote units (RTUs), and breaking industrial control system (ICS) protocols to degrade reliability
Mitigation And Actionable Advice

CISA encourages organizations to take immediate action:
- Enhance authentication: implement strict MFA, and eliminate default credentials.
- Ensure control systems are not directly accessible from the internet. Remove unnecessary network exposure.
- Monitoring column: Implement continuous monitoring programs to detect anomalies as highlighted on the CISA ICS web page.
- Review advisories: organizations should review specific advisories, such as the Superpower Sun Power PVS 6 device vulnerability (CVE 2025-9696).
The US Cybersecurity and Infrastructure Security Agency (CISA) published four new advisories on industrial control systems on Tuesday. These advisories detail vulnerabilities in equipment from Delta Electronics, Fuji Electric, Sun Power, and Hitachi Energy. The agency said these advisories provide essential technical information and mitigation guidance for asset owners and operators across the critical infrastructure sector.

The advisory covering Delta Electronics points to an improper restriction of XML external entity reference vulnerability in the company's EIP Builder, an engineering tool used to build and manage Ethernet/IP networks. Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in the disclosure of sensitive information.

Deployed in the global critical manufacturing sector, CISA noted that the affected product is vulnerable to an XML external entity vulnerability, which could allow an attacker to disclose sensitive information. The vulnerability is tracked as CSCVE 2025.577704. It carries a CVSS v3.1 base score of 5.5. The updated CVSS v4 rating is 6.7.

KIMIYA, together with the Trend Micro Zero Day Initiative, reported this vulnerability to CISA. Delta Electronics recommends users update to V1.12 CISA 1. Attackers with network access could exploit the flaw to change configurations or disrupt operations. The company urges operators to apply security updates and recommended hardening steps.

A second advisory highlighted vulnerabilities in Fuji Electric’s FRENIC Loader 4 software, which is used with the company’s variable frequency drives. The flaws could allow arbitrary code execution or unauthorized system access, potentially enabling control hijacking or the forced shutdown of industrial processes. Fuji Electric’s FRE NIC Loader 4 is affected in versions earlier than 1.4.0.1.

Deployed across commercial facilities, the advisory identified that the affected product is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-969365. It has a CVSS v3.1 base score of 7.8, and in CVSS v4, the score rises to 8.4.

Kimiya also reported this vulnerability to CISA. Fuji Electric recommends users update to V1.1.4.0.1. CISA also disclosed weaknesses in SunPower's PVS6 device. The device aggregates data from photovoltaic systems and sends it to monitoring platforms. According to CISA, the flaws could compromise visibility into solar assets. They may also allow broader disruption across renewable energy environments.

The advisory added that successful exploitation of this vulnerability could allow attackers full access to the device, enabling them to replace firmware (the device's permanent software), modify settings, disable the device, create secure shell (SSH) tunnels for remote access, and manipulate attached devices.

The SunPower PVS 6's Bluetooth Low Energy (LE) SAR interface is vulnerable due to its use of hard-coded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows actions such as replacing the firmware (the permanent controlling software), disabling power production, changing grid settings, creating SSH (secure shell) tunnels for remote access, altering firewall settings, and manipulating connected devices. The vulnerability is tracked as CVE-2025-9696. It has a CVSS (Common Vulnerability Scoring System) v3.1 base score of 9.6, while the CVSS v4 score is 9.4.

Deployed across the global energy sector, Dagan and Henderson reported this vulnerability to CISA. However, SunPower did not respond to two CISS attempts to coordinate on these vulnerabilities. The last CISA ICS advisory updates a previous notice on Hitachi Energy’s Real Relion 670 and 650 series protection relays and SAM 600 IO modules. These systems are crucial for substation operations and high-voltage grid protection. The updated advisory gives more technical information and new mitigation strategies for power-sector operators.tors.

Hitachi Energy confirmed that multiple product lines are affected. The Relion 650 is impacted in versions 2.2.4.4 and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.6.2. The Relion 672 is affected in versions 2.2.2.6, 2.2.3.7, 2.2.4.4, and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.2.6.2. Additionally, the SAM 600 IO is vulnerable in version 2.2.5.6.

Deployed across the energy sector, CISA identified a denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanisms in the Relion 670/650 and SAM 600 I/O series devices, which, if exploited, could cause critical functions, such as the LDC (line distance communication module), to malfunction. The vulnerability is tracked as CVE-2025-2403. It has a CVSS v3.1 base score of 7.5, while the CVSS v4 score is 8.7.

Hitar G Energy PSIRT reported this vulnerability to CISA. Hitachi Energy outlined several specific workarounds and motivations to reduce risk for the Relion 670 series, version 2.2.6 revisions up to 2.2.6.2, and the Relion 650 series, version 2.2.6 revisions up to 2.2.6.2. The issue has been fixed in version 2.2.6.3, and users are advised to update to version 2.2.6.4 or later.

For the Relion 670 series version 2.2.5.6, the Relion 650 series version 2.2.5.6, and the SAM 600 IO series version 2.2.5.6, the flaw has been resolved in version 2.2.5.7, with updates recommended to version 2.2.5.8 or later. For the Relion 670 series (version 2.2.4.4) and the Relion 650 series (version 2.2.4), users should update to version 2.2.4.5 or later for all affected products. Hitachi Energy also recommends applying the general mitigation measures provided.

CISA encouraged asset owners, administrators, and security teams to review the advisories in full, apply vendor-issued patches, and adopt layered defense measures to safeguard against potential exploitation. While the agency said it has not observed active exploitation of the vulnerabilities, it emphasized that attackers continue to target operational technology systems in ongoing campaigns against critical infrastructure.

The latest advisories reflect a persistent trend of recurring security flaws across the industrial technology ecosystem. In operational technology, these updates are a reminder that vulnerabilities persist and that patching challenges, legacy systems, and operational risks must be factored into defense strategies.

Just last week, CISA released nine ICS advisories addressing cybersecurity vulnerabilities and risks for asset owners and operators across the critical infrastructure sector. The advisories cover urgent vulnerabilities in hardware and software, including CPU modules from Mitsubishi Electric, remote terminal units from Schneider Electric, CNC tools and communications from Delta Electronics, SCADA (supervisory control and data acquisition) platforms from GE Vernova, and various Mitsubishi FA tools and protection relay systems from Hitachi Energy.

Source: CISA advisories detail ICS flaws in Delta, Fuji Electric, SunPower, Hitachi Energy hardware; provide mitigation
Tech Reviews
CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount disruptive cyberattacks. These threats target vulnerable operational technology (OT) and legacy components, often exploiting weak authentication and edge devices.

Key vulnerabilities and Risks
- Targeted infrastructure: increased cyber threats target renewable energy systems, such as solar and wind installations, and electricity grid management devices that help operate and monitor the power grid.
- Prepositioning attacks—such as Chinese state‑sponsored access (e.g., Volt Typhoon)—have compromised IT networks to enable future disciples.
- About 75% of transmission lines are over 25 years old. These systems often run unsupported software and lack modern security.
- Common attack vectors: attackers exploit weak passwords, a lack of multifactor authentication (MFA), and internet-facing OT devices.
- Specific threats, column, malware capabilities, inflow, targeting remote units (RTUs), and breaking industrial control system (ICS) protocols to degrade reliability
Mitigation And Actionable Advice

CISA encourages organizations to take immediate action:
- Enhance authentication: implement strict MFA, and eliminate default credentials.
- Ensure control systems are not directly accessible from the internet. Remove unnecessary network exposure.
- Monitoring column: Implement continuous monitoring programs to detect anomalies as highlighted on the CISA ICS web page.
- Review advisories: organizations should review specific advisories, such as the Superpower Sun Power PVS 6 device vulnerability (CVE 2025-9696).
The US Cybersecurity and Infrastructure Security Agency (CISA) published four new advisories on industrial control systems on Tuesday. These advisories detail vulnerabilities in equipment from Delta Electronics, Fuji Electric, Sun Power, and Hitachi Energy. The agency said these advisories provide essential technical information and mitigation guidance for asset owners and operators across the critical infrastructure sector.

The advisory covering Delta Electronics points to an improper restriction of XML external entity reference vulnerability in the company's EIP Builder, an engineering tool used to build and manage Ethernet/IP networks. Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in the disclosure of sensitive information.

Deployed in the global critical manufacturing sector, CISA noted that the affected product is vulnerable to an XML external entity vulnerability, which could allow an attacker to disclose sensitive information. The vulnerability is tracked as CSCVE 2025.577704. It carries a CVSS v3.1 base score of 5.5. The updated CVSS v4 rating is 6.7.

KIMIYA, together with the Trend Micro Zero Day Initiative, reported this vulnerability to CISA. Delta Electronics recommends users update to V1.12 CISA 1. Attackers with network access could exploit the flaw to change configurations or disrupt operations. The company urges operators to apply security updates and recommended hardening steps.

A second advisory highlighted vulnerabilities in Fuji Electric’s FRENIC Loader 4 software, which is used with the company’s variable frequency drives. The flaws could allow arbitrary code execution or unauthorized system access, potentially enabling control hijacking or the forced shutdown of industrial processes. Fuji Electric’s FRE NIC Loader 4 is affected in versions earlier than 1.4.0.1.

Deployed across commercial facilities, the advisory identified that the affected product is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-969365. It has a CVSS v3.1 base score of 7.8, and in CVSS v4, the score rises to 8.4.

Kimiya also reported this vulnerability to CISA. Fuji Electric recommends users update to V1.1.4.0.1. CISA also disclosed weaknesses in SunPower's PVS6 device. The device aggregates data from photovoltaic systems and sends it to monitoring platforms. According to CISA, the flaws could compromise visibility into solar assets. They may also allow broader disruption across renewable energy environments.

The advisory added that successful exploitation of this vulnerability could allow attackers full access to the device, enabling them to replace firmware (the device's permanent software), modify settings, disable the device, create secure shell (SSH) tunnels for remote access, and manipulate attached devices.

The SunPower PVS 6's Bluetooth Low Energy (LE) SAR interface is vulnerable due to its use of hard-coded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows actions such as replacing the firmware (the permanent controlling software), disabling power production, changing grid settings, creating SSH (secure shell) tunnels for remote access, altering firewall settings, and manipulating connected devices. The vulnerability is tracked as CVE-2025-9696. It has a CVSS (Common Vulnerability Scoring System) v3.1 base score of 9.6, while the CVSS v4 score is 9.4.

Deployed across the global energy sector, Dagan and Henderson reported this vulnerability to CISA. However, SunPower did not respond to two CISS attempts to coordinate on these vulnerabilities. The last CISA ICS advisory updates a previous notice on Hitachi Energy’s Real Relion 670 and 650 series protection relays and SAM 600 IO modules. These systems are crucial for substation operations and high-voltage grid protection. The updated advisory gives more technical information and new mitigation strategies for power-sector operators.tors.

Hitachi Energy confirmed that multiple product lines are affected. The Relion 650 is impacted in versions 2.2.4.4 and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.6.2. The Relion 672 is affected in versions 2.2.2.6, 2.2.3.7, 2.2.4.4, and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.2.6.2. Additionally, the SAM 600 IO is vulnerable in version 2.2.5.6.

Deployed across the energy sector, CISA identified a denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanisms in the Relion 670/650 and SAM 600 I/O series devices, which, if exploited, could cause critical functions, such as the LDC (line distance communication module), to malfunction. The vulnerability is tracked as CVE-2025-2403. It has a CVSS v3.1 base score of 7.5, while the CVSS v4 score is 8.7.

Hitar G Energy PSIRT reported this vulnerability to CISA. Hitachi Energy outlined several specific workarounds and motivations to reduce risk for the Relion 670 series, version 2.2.6 revisions up to 2.2.6.2, and the Relion 650 series, version 2.2.6 revisions up to 2.2.6.2. The issue has been fixed in version 2.2.6.3, and users are advised to update to version 2.2.6.4 or later.

For the Relion 670 series version 2.2.5.6, the Relion 650 series version 2.2.5.6, and the SAM 600 IO series version 2.2.5.6, the flaw has been resolved in version 2.2.5.7, with updates recommended to version 2.2.5.8 or later. For the Relion 670 series (version 2.2.4.4) and the Relion 650 series (version 2.2.4), users should update to version 2.2.4.5 or later for all affected products. Hitachi Energy also recommends applying the general mitigation measures provided.

CISA encouraged asset owners, administrators, and security teams to review the advisories in full, apply vendor-issued patches, and adopt layered defense measures to safeguard against potential exploitation. While the agency said it has not observed active exploitation of the vulnerabilities, it emphasized that attackers continue to target operational technology systems in ongoing campaigns against critical infrastructure.

The latest advisories reflect a persistent trend of recurring security flaws across the industrial technology ecosystem. In operational technology, these updates are a reminder that vulnerabilities persist and that patching challenges, legacy systems, and operational risks must be factored into defense strategies.

Just last week, CISA released nine ICS advisories addressing cybersecurity vulnerabilities and risks for asset owners and operators across the critical infrastructure sector. The advisories cover urgent vulnerabilities in hardware and software, including CPU modules from Mitsubishi Electric, remote terminal units from Schneider Electric, CNC tools and communications from Delta Electronics, SCADA (supervisory control and data acquisition) platforms from GE Vernova, and various Mitsubishi FA tools and protection relay systems from Hitachi Energy.

Source: CISA advisories detail ICS flaws in Delta, Fuji Electric, SunPower, Hitachi Energy hardware; provide mitigation
- AI
- Troubleshooting
- Smartwatches
- Smartphones
- Camera
- Gadgets
- Games
- Laptops
- Seasonal Sales
Phone Features
CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount disruptive cyberattacks. These threats target vulnerable operational technology (OT) and legacy components, often exploiting weak authentication and edge devices.

Key vulnerabilities and Risks
- Targeted infrastructure: increased cyber threats target renewable energy systems, such as solar and wind installations, and electricity grid management devices that help operate and monitor the power grid.
- Prepositioning attacks—such as Chinese state‑sponsored access (e.g., Volt Typhoon)—have compromised IT networks to enable future disciples.
- About 75% of transmission lines are over 25 years old. These systems often run unsupported software and lack modern security.
- Common attack vectors: attackers exploit weak passwords, a lack of multifactor authentication (MFA), and internet-facing OT devices.
- Specific threats, column, malware capabilities, inflow, targeting remote units (RTUs), and breaking industrial control system (ICS) protocols to degrade reliability
Mitigation And Actionable Advice

CISA encourages organizations to take immediate action:
- Enhance authentication: implement strict MFA, and eliminate default credentials.
- Ensure control systems are not directly accessible from the internet. Remove unnecessary network exposure.
- Monitoring column: Implement continuous monitoring programs to detect anomalies as highlighted on the CISA ICS web page.
- Review advisories: organizations should review specific advisories, such as the Superpower Sun Power PVS 6 device vulnerability (CVE 2025-9696).
The US Cybersecurity and Infrastructure Security Agency (CISA) published four new advisories on industrial control systems on Tuesday. These advisories detail vulnerabilities in equipment from Delta Electronics, Fuji Electric, Sun Power, and Hitachi Energy. The agency said these advisories provide essential technical information and mitigation guidance for asset owners and operators across the critical infrastructure sector.

The advisory covering Delta Electronics points to an improper restriction of XML external entity reference vulnerability in the company's EIP Builder, an engineering tool used to build and manage Ethernet/IP networks. Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in the disclosure of sensitive information.

Deployed in the global critical manufacturing sector, CISA noted that the affected product is vulnerable to an XML external entity vulnerability, which could allow an attacker to disclose sensitive information. The vulnerability is tracked as CSCVE 2025.577704. It carries a CVSS v3.1 base score of 5.5. The updated CVSS v4 rating is 6.7.

KIMIYA, together with the Trend Micro Zero Day Initiative, reported this vulnerability to CISA. Delta Electronics recommends users update to V1.12 CISA 1. Attackers with network access could exploit the flaw to change configurations or disrupt operations. The company urges operators to apply security updates and recommended hardening steps.

A second advisory highlighted vulnerabilities in Fuji Electric’s FRENIC Loader 4 software, which is used with the company’s variable frequency drives. The flaws could allow arbitrary code execution or unauthorized system access, potentially enabling control hijacking or the forced shutdown of industrial processes. Fuji Electric’s FRE NIC Loader 4 is affected in versions earlier than 1.4.0.1.

Deployed across commercial facilities, the advisory identified that the affected product is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-969365. It has a CVSS v3.1 base score of 7.8, and in CVSS v4, the score rises to 8.4.

Kimiya also reported this vulnerability to CISA. Fuji Electric recommends users update to V1.1.4.0.1. CISA also disclosed weaknesses in SunPower's PVS6 device. The device aggregates data from photovoltaic systems and sends it to monitoring platforms. According to CISA, the flaws could compromise visibility into solar assets. They may also allow broader disruption across renewable energy environments.

The advisory added that successful exploitation of this vulnerability could allow attackers full access to the device, enabling them to replace firmware (the device's permanent software), modify settings, disable the device, create secure shell (SSH) tunnels for remote access, and manipulate attached devices.

The SunPower PVS 6's Bluetooth Low Energy (LE) SAR interface is vulnerable due to its use of hard-coded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows actions such as replacing the firmware (the permanent controlling software), disabling power production, changing grid settings, creating SSH (secure shell) tunnels for remote access, altering firewall settings, and manipulating connected devices. The vulnerability is tracked as CVE-2025-9696. It has a CVSS (Common Vulnerability Scoring System) v3.1 base score of 9.6, while the CVSS v4 score is 9.4.

Deployed across the global energy sector, Dagan and Henderson reported this vulnerability to CISA. However, SunPower did not respond to two CISS attempts to coordinate on these vulnerabilities. The last CISA ICS advisory updates a previous notice on Hitachi Energy’s Real Relion 670 and 650 series protection relays and SAM 600 IO modules. These systems are crucial for substation operations and high-voltage grid protection. The updated advisory gives more technical information and new mitigation strategies for power-sector operators.tors.

Hitachi Energy confirmed that multiple product lines are affected. The Relion 650 is impacted in versions 2.2.4.4 and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.6.2. The Relion 672 is affected in versions 2.2.2.6, 2.2.3.7, 2.2.4.4, and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.2.6.2. Additionally, the SAM 600 IO is vulnerable in version 2.2.5.6.

Deployed across the energy sector, CISA identified a denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanisms in the Relion 670/650 and SAM 600 I/O series devices, which, if exploited, could cause critical functions, such as the LDC (line distance communication module), to malfunction. The vulnerability is tracked as CVE-2025-2403. It has a CVSS v3.1 base score of 7.5, while the CVSS v4 score is 8.7.

Hitar G Energy PSIRT reported this vulnerability to CISA. Hitachi Energy outlined several specific workarounds and motivations to reduce risk for the Relion 670 series, version 2.2.6 revisions up to 2.2.6.2, and the Relion 650 series, version 2.2.6 revisions up to 2.2.6.2. The issue has been fixed in version 2.2.6.3, and users are advised to update to version 2.2.6.4 or later.

For the Relion 670 series version 2.2.5.6, the Relion 650 series version 2.2.5.6, and the SAM 600 IO series version 2.2.5.6, the flaw has been resolved in version 2.2.5.7, with updates recommended to version 2.2.5.8 or later. For the Relion 670 series (version 2.2.4.4) and the Relion 650 series (version 2.2.4), users should update to version 2.2.4.5 or later for all affected products. Hitachi Energy also recommends applying the general mitigation measures provided.

CISA encouraged asset owners, administrators, and security teams to review the advisories in full, apply vendor-issued patches, and adopt layered defense measures to safeguard against potential exploitation. While the agency said it has not observed active exploitation of the vulnerabilities, it emphasized that attackers continue to target operational technology systems in ongoing campaigns against critical infrastructure.

The latest advisories reflect a persistent trend of recurring security flaws across the industrial technology ecosystem. In operational technology, these updates are a reminder that vulnerabilities persist and that patching challenges, legacy systems, and operational risks must be factored into defense strategies.

Just last week, CISA released nine ICS advisories addressing cybersecurity vulnerabilities and risks for asset owners and operators across the critical infrastructure sector. The advisories cover urgent vulnerabilities in hardware and software, including CPU modules from Mitsubishi Electric, remote terminal units from Schneider Electric, CNC tools and communications from Delta Electronics, SCADA (supervisory control and data acquisition) platforms from GE Vernova, and various Mitsubishi FA tools and protection relay systems from Hitachi Energy.

Source: CISA advisories detail ICS flaws in Delta, Fuji Electric, SunPower, Hitachi Energy hardware; provide mitigation
Buying Guides
CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount disruptive cyberattacks. These threats target vulnerable operational technology (OT) and legacy components, often exploiting weak authentication and edge devices.

Key vulnerabilities and Risks
- Targeted infrastructure: increased cyber threats target renewable energy systems, such as solar and wind installations, and electricity grid management devices that help operate and monitor the power grid.
- Prepositioning attacks—such as Chinese state‑sponsored access (e.g., Volt Typhoon)—have compromised IT networks to enable future disciples.
- About 75% of transmission lines are over 25 years old. These systems often run unsupported software and lack modern security.
- Common attack vectors: attackers exploit weak passwords, a lack of multifactor authentication (MFA), and internet-facing OT devices.
- Specific threats, column, malware capabilities, inflow, targeting remote units (RTUs), and breaking industrial control system (ICS) protocols to degrade reliability
Mitigation And Actionable Advice

CISA encourages organizations to take immediate action:
- Enhance authentication: implement strict MFA, and eliminate default credentials.
- Ensure control systems are not directly accessible from the internet. Remove unnecessary network exposure.
- Monitoring column: Implement continuous monitoring programs to detect anomalies as highlighted on the CISA ICS web page.
- Review advisories: organizations should review specific advisories, such as the Superpower Sun Power PVS 6 device vulnerability (CVE 2025-9696).
The US Cybersecurity and Infrastructure Security Agency (CISA) published four new advisories on industrial control systems on Tuesday. These advisories detail vulnerabilities in equipment from Delta Electronics, Fuji Electric, Sun Power, and Hitachi Energy. The agency said these advisories provide essential technical information and mitigation guidance for asset owners and operators across the critical infrastructure sector.

The advisory covering Delta Electronics points to an improper restriction of XML external entity reference vulnerability in the company's EIP Builder, an engineering tool used to build and manage Ethernet/IP networks. Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in the disclosure of sensitive information.

Deployed in the global critical manufacturing sector, CISA noted that the affected product is vulnerable to an XML external entity vulnerability, which could allow an attacker to disclose sensitive information. The vulnerability is tracked as CSCVE 2025.577704. It carries a CVSS v3.1 base score of 5.5. The updated CVSS v4 rating is 6.7.

KIMIYA, together with the Trend Micro Zero Day Initiative, reported this vulnerability to CISA. Delta Electronics recommends users update to V1.12 CISA 1. Attackers with network access could exploit the flaw to change configurations or disrupt operations. The company urges operators to apply security updates and recommended hardening steps.

A second advisory highlighted vulnerabilities in Fuji Electric’s FRENIC Loader 4 software, which is used with the company’s variable frequency drives. The flaws could allow arbitrary code execution or unauthorized system access, potentially enabling control hijacking or the forced shutdown of industrial processes. Fuji Electric’s FRE NIC Loader 4 is affected in versions earlier than 1.4.0.1.

Deployed across commercial facilities, the advisory identified that the affected product is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-969365. It has a CVSS v3.1 base score of 7.8, and in CVSS v4, the score rises to 8.4.

Kimiya also reported this vulnerability to CISA. Fuji Electric recommends users update to V1.1.4.0.1. CISA also disclosed weaknesses in SunPower's PVS6 device. The device aggregates data from photovoltaic systems and sends it to monitoring platforms. According to CISA, the flaws could compromise visibility into solar assets. They may also allow broader disruption across renewable energy environments.

The advisory added that successful exploitation of this vulnerability could allow attackers full access to the device, enabling them to replace firmware (the device's permanent software), modify settings, disable the device, create secure shell (SSH) tunnels for remote access, and manipulate attached devices.

The SunPower PVS 6's Bluetooth Low Energy (LE) SAR interface is vulnerable due to its use of hard-coded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows actions such as replacing the firmware (the permanent controlling software), disabling power production, changing grid settings, creating SSH (secure shell) tunnels for remote access, altering firewall settings, and manipulating connected devices. The vulnerability is tracked as CVE-2025-9696. It has a CVSS (Common Vulnerability Scoring System) v3.1 base score of 9.6, while the CVSS v4 score is 9.4.

Deployed across the global energy sector, Dagan and Henderson reported this vulnerability to CISA. However, SunPower did not respond to two CISS attempts to coordinate on these vulnerabilities. The last CISA ICS advisory updates a previous notice on Hitachi Energy’s Real Relion 670 and 650 series protection relays and SAM 600 IO modules. These systems are crucial for substation operations and high-voltage grid protection. The updated advisory gives more technical information and new mitigation strategies for power-sector operators.tors.

Hitachi Energy confirmed that multiple product lines are affected. The Relion 650 is impacted in versions 2.2.4.4 and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.6.2. The Relion 672 is affected in versions 2.2.2.6, 2.2.3.7, 2.2.4.4, and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.2.6.2. Additionally, the SAM 600 IO is vulnerable in version 2.2.5.6.

Deployed across the energy sector, CISA identified a denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanisms in the Relion 670/650 and SAM 600 I/O series devices, which, if exploited, could cause critical functions, such as the LDC (line distance communication module), to malfunction. The vulnerability is tracked as CVE-2025-2403. It has a CVSS v3.1 base score of 7.5, while the CVSS v4 score is 8.7.

Hitar G Energy PSIRT reported this vulnerability to CISA. Hitachi Energy outlined several specific workarounds and motivations to reduce risk for the Relion 670 series, version 2.2.6 revisions up to 2.2.6.2, and the Relion 650 series, version 2.2.6 revisions up to 2.2.6.2. The issue has been fixed in version 2.2.6.3, and users are advised to update to version 2.2.6.4 or later.

For the Relion 670 series version 2.2.5.6, the Relion 650 series version 2.2.5.6, and the SAM 600 IO series version 2.2.5.6, the flaw has been resolved in version 2.2.5.7, with updates recommended to version 2.2.5.8 or later. For the Relion 670 series (version 2.2.4.4) and the Relion 650 series (version 2.2.4), users should update to version 2.2.4.5 or later for all affected products. Hitachi Energy also recommends applying the general mitigation measures provided.

CISA encouraged asset owners, administrators, and security teams to review the advisories in full, apply vendor-issued patches, and adopt layered defense measures to safeguard against potential exploitation. While the agency said it has not observed active exploitation of the vulnerabilities, it emphasized that attackers continue to target operational technology systems in ongoing campaigns against critical infrastructure.

The latest advisories reflect a persistent trend of recurring security flaws across the industrial technology ecosystem. In operational technology, these updates are a reminder that vulnerabilities persist and that patching challenges, legacy systems, and operational risks must be factored into defense strategies.

Just last week, CISA released nine ICS advisories addressing cybersecurity vulnerabilities and risks for asset owners and operators across the critical infrastructure sector. The advisories cover urgent vulnerabilities in hardware and software, including CPU modules from Mitsubishi Electric, remote terminal units from Schneider Electric, CNC tools and communications from Delta Electronics, SCADA (supervisory control and data acquisition) platforms from GE Vernova, and various Mitsubishi FA tools and protection relay systems from Hitachi Energy.

Source: CISA advisories detail ICS flaws in Delta, Fuji Electric, SunPower, Hitachi Energy hardware; provide mitigation
Comparison
CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount disruptive cyberattacks. These threats target vulnerable operational technology (OT) and legacy components, often exploiting weak authentication and edge devices.

Key vulnerabilities and Risks
- Targeted infrastructure: increased cyber threats target renewable energy systems, such as solar and wind installations, and electricity grid management devices that help operate and monitor the power grid.
- Prepositioning attacks—such as Chinese state‑sponsored access (e.g., Volt Typhoon)—have compromised IT networks to enable future disciples.
- About 75% of transmission lines are over 25 years old. These systems often run unsupported software and lack modern security.
- Common attack vectors: attackers exploit weak passwords, a lack of multifactor authentication (MFA), and internet-facing OT devices.
- Specific threats, column, malware capabilities, inflow, targeting remote units (RTUs), and breaking industrial control system (ICS) protocols to degrade reliability
Mitigation And Actionable Advice

CISA encourages organizations to take immediate action:
- Enhance authentication: implement strict MFA, and eliminate default credentials.
- Ensure control systems are not directly accessible from the internet. Remove unnecessary network exposure.
- Monitoring column: Implement continuous monitoring programs to detect anomalies as highlighted on the CISA ICS web page.
- Review advisories: organizations should review specific advisories, such as the Superpower Sun Power PVS 6 device vulnerability (CVE 2025-9696).
The US Cybersecurity and Infrastructure Security Agency (CISA) published four new advisories on industrial control systems on Tuesday. These advisories detail vulnerabilities in equipment from Delta Electronics, Fuji Electric, Sun Power, and Hitachi Energy. The agency said these advisories provide essential technical information and mitigation guidance for asset owners and operators across the critical infrastructure sector.

The advisory covering Delta Electronics points to an improper restriction of XML external entity reference vulnerability in the company's EIP Builder, an engineering tool used to build and manage Ethernet/IP networks. Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in the disclosure of sensitive information.

Deployed in the global critical manufacturing sector, CISA noted that the affected product is vulnerable to an XML external entity vulnerability, which could allow an attacker to disclose sensitive information. The vulnerability is tracked as CSCVE 2025.577704. It carries a CVSS v3.1 base score of 5.5. The updated CVSS v4 rating is 6.7.

KIMIYA, together with the Trend Micro Zero Day Initiative, reported this vulnerability to CISA. Delta Electronics recommends users update to V1.12 CISA 1. Attackers with network access could exploit the flaw to change configurations or disrupt operations. The company urges operators to apply security updates and recommended hardening steps.

A second advisory highlighted vulnerabilities in Fuji Electric’s FRENIC Loader 4 software, which is used with the company’s variable frequency drives. The flaws could allow arbitrary code execution or unauthorized system access, potentially enabling control hijacking or the forced shutdown of industrial processes. Fuji Electric’s FRE NIC Loader 4 is affected in versions earlier than 1.4.0.1.

Deployed across commercial facilities, the advisory identified that the affected product is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-969365. It has a CVSS v3.1 base score of 7.8, and in CVSS v4, the score rises to 8.4.

Kimiya also reported this vulnerability to CISA. Fuji Electric recommends users update to V1.1.4.0.1. CISA also disclosed weaknesses in SunPower's PVS6 device. The device aggregates data from photovoltaic systems and sends it to monitoring platforms. According to CISA, the flaws could compromise visibility into solar assets. They may also allow broader disruption across renewable energy environments.

The advisory added that successful exploitation of this vulnerability could allow attackers full access to the device, enabling them to replace firmware (the device's permanent software), modify settings, disable the device, create secure shell (SSH) tunnels for remote access, and manipulate attached devices.

The SunPower PVS 6's Bluetooth Low Energy (LE) SAR interface is vulnerable due to its use of hard-coded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows actions such as replacing the firmware (the permanent controlling software), disabling power production, changing grid settings, creating SSH (secure shell) tunnels for remote access, altering firewall settings, and manipulating connected devices. The vulnerability is tracked as CVE-2025-9696. It has a CVSS (Common Vulnerability Scoring System) v3.1 base score of 9.6, while the CVSS v4 score is 9.4.

Deployed across the global energy sector, Dagan and Henderson reported this vulnerability to CISA. However, SunPower did not respond to two CISS attempts to coordinate on these vulnerabilities. The last CISA ICS advisory updates a previous notice on Hitachi Energy’s Real Relion 670 and 650 series protection relays and SAM 600 IO modules. These systems are crucial for substation operations and high-voltage grid protection. The updated advisory gives more technical information and new mitigation strategies for power-sector operators.tors.

Hitachi Energy confirmed that multiple product lines are affected. The Relion 650 is impacted in versions 2.2.4.4 and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.6.2. The Relion 672 is affected in versions 2.2.2.6, 2.2.3.7, 2.2.4.4, and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.2.6.2. Additionally, the SAM 600 IO is vulnerable in version 2.2.5.6.

Deployed across the energy sector, CISA identified a denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanisms in the Relion 670/650 and SAM 600 I/O series devices, which, if exploited, could cause critical functions, such as the LDC (line distance communication module), to malfunction. The vulnerability is tracked as CVE-2025-2403. It has a CVSS v3.1 base score of 7.5, while the CVSS v4 score is 8.7.

Hitar G Energy PSIRT reported this vulnerability to CISA. Hitachi Energy outlined several specific workarounds and motivations to reduce risk for the Relion 670 series, version 2.2.6 revisions up to 2.2.6.2, and the Relion 650 series, version 2.2.6 revisions up to 2.2.6.2. The issue has been fixed in version 2.2.6.3, and users are advised to update to version 2.2.6.4 or later.

For the Relion 670 series version 2.2.5.6, the Relion 650 series version 2.2.5.6, and the SAM 600 IO series version 2.2.5.6, the flaw has been resolved in version 2.2.5.7, with updates recommended to version 2.2.5.8 or later. For the Relion 670 series (version 2.2.4.4) and the Relion 650 series (version 2.2.4), users should update to version 2.2.4.5 or later for all affected products. Hitachi Energy also recommends applying the general mitigation measures provided.

CISA encouraged asset owners, administrators, and security teams to review the advisories in full, apply vendor-issued patches, and adopt layered defense measures to safeguard against potential exploitation. While the agency said it has not observed active exploitation of the vulnerabilities, it emphasized that attackers continue to target operational technology systems in ongoing campaigns against critical infrastructure.

The latest advisories reflect a persistent trend of recurring security flaws across the industrial technology ecosystem. In operational technology, these updates are a reminder that vulnerabilities persist and that patching challenges, legacy systems, and operational risks must be factored into defense strategies.

Just last week, CISA released nine ICS advisories addressing cybersecurity vulnerabilities and risks for asset owners and operators across the critical infrastructure sector. The advisories cover urgent vulnerabilities in hardware and software, including CPU modules from Mitsubishi Electric, remote terminal units from Schneider Electric, CNC tools and communications from Delta Electronics, SCADA (supervisory control and data acquisition) platforms from GE Vernova, and various Mitsubishi FA tools and protection relay systems from Hitachi Energy.

Source: CISA advisories detail ICS flaws in Delta, Fuji Electric, SunPower, Hitachi Energy hardware; provide mitigation
News
CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount disruptive cyberattacks. These threats target vulnerable operational technology (OT) and legacy components, often exploiting weak authentication and edge devices.

Key vulnerabilities and Risks
- Targeted infrastructure: increased cyber threats target renewable energy systems, such as solar and wind installations, and electricity grid management devices that help operate and monitor the power grid.
- Prepositioning attacks—such as Chinese state‑sponsored access (e.g., Volt Typhoon)—have compromised IT networks to enable future disciples.
- About 75% of transmission lines are over 25 years old. These systems often run unsupported software and lack modern security.
- Common attack vectors: attackers exploit weak passwords, a lack of multifactor authentication (MFA), and internet-facing OT devices.
- Specific threats, column, malware capabilities, inflow, targeting remote units (RTUs), and breaking industrial control system (ICS) protocols to degrade reliability
Mitigation And Actionable Advice

CISA encourages organizations to take immediate action:
- Enhance authentication: implement strict MFA, and eliminate default credentials.
- Ensure control systems are not directly accessible from the internet. Remove unnecessary network exposure.
- Monitoring column: Implement continuous monitoring programs to detect anomalies as highlighted on the CISA ICS web page.
- Review advisories: organizations should review specific advisories, such as the Superpower Sun Power PVS 6 device vulnerability (CVE 2025-9696).
The US Cybersecurity and Infrastructure Security Agency (CISA) published four new advisories on industrial control systems on Tuesday. These advisories detail vulnerabilities in equipment from Delta Electronics, Fuji Electric, Sun Power, and Hitachi Energy. The agency said these advisories provide essential technical information and mitigation guidance for asset owners and operators across the critical infrastructure sector.

The advisory covering Delta Electronics points to an improper restriction of XML external entity reference vulnerability in the company's EIP Builder, an engineering tool used to build and manage Ethernet/IP networks. Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in the disclosure of sensitive information.

Deployed in the global critical manufacturing sector, CISA noted that the affected product is vulnerable to an XML external entity vulnerability, which could allow an attacker to disclose sensitive information. The vulnerability is tracked as CSCVE 2025.577704. It carries a CVSS v3.1 base score of 5.5. The updated CVSS v4 rating is 6.7.

KIMIYA, together with the Trend Micro Zero Day Initiative, reported this vulnerability to CISA. Delta Electronics recommends users update to V1.12 CISA 1. Attackers with network access could exploit the flaw to change configurations or disrupt operations. The company urges operators to apply security updates and recommended hardening steps.

A second advisory highlighted vulnerabilities in Fuji Electric’s FRENIC Loader 4 software, which is used with the company’s variable frequency drives. The flaws could allow arbitrary code execution or unauthorized system access, potentially enabling control hijacking or the forced shutdown of industrial processes. Fuji Electric’s FRE NIC Loader 4 is affected in versions earlier than 1.4.0.1.

Deployed across commercial facilities, the advisory identified that the affected product is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-969365. It has a CVSS v3.1 base score of 7.8, and in CVSS v4, the score rises to 8.4.

Kimiya also reported this vulnerability to CISA. Fuji Electric recommends users update to V1.1.4.0.1. CISA also disclosed weaknesses in SunPower's PVS6 device. The device aggregates data from photovoltaic systems and sends it to monitoring platforms. According to CISA, the flaws could compromise visibility into solar assets. They may also allow broader disruption across renewable energy environments.

The advisory added that successful exploitation of this vulnerability could allow attackers full access to the device, enabling them to replace firmware (the device's permanent software), modify settings, disable the device, create secure shell (SSH) tunnels for remote access, and manipulate attached devices.

The SunPower PVS 6's Bluetooth Low Energy (LE) SAR interface is vulnerable due to its use of hard-coded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows actions such as replacing the firmware (the permanent controlling software), disabling power production, changing grid settings, creating SSH (secure shell) tunnels for remote access, altering firewall settings, and manipulating connected devices. The vulnerability is tracked as CVE-2025-9696. It has a CVSS (Common Vulnerability Scoring System) v3.1 base score of 9.6, while the CVSS v4 score is 9.4.

Deployed across the global energy sector, Dagan and Henderson reported this vulnerability to CISA. However, SunPower did not respond to two CISS attempts to coordinate on these vulnerabilities. The last CISA ICS advisory updates a previous notice on Hitachi Energy’s Real Relion 670 and 650 series protection relays and SAM 600 IO modules. These systems are crucial for substation operations and high-voltage grid protection. The updated advisory gives more technical information and new mitigation strategies for power-sector operators.tors.

Hitachi Energy confirmed that multiple product lines are affected. The Relion 650 is impacted in versions 2.2.4.4 and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.6.2. The Relion 672 is affected in versions 2.2.2.6, 2.2.3.7, 2.2.4.4, and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.2.6.2. Additionally, the SAM 600 IO is vulnerable in version 2.2.5.6.

Deployed across the energy sector, CISA identified a denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanisms in the Relion 670/650 and SAM 600 I/O series devices, which, if exploited, could cause critical functions, such as the LDC (line distance communication module), to malfunction. The vulnerability is tracked as CVE-2025-2403. It has a CVSS v3.1 base score of 7.5, while the CVSS v4 score is 8.7.

Hitar G Energy PSIRT reported this vulnerability to CISA. Hitachi Energy outlined several specific workarounds and motivations to reduce risk for the Relion 670 series, version 2.2.6 revisions up to 2.2.6.2, and the Relion 650 series, version 2.2.6 revisions up to 2.2.6.2. The issue has been fixed in version 2.2.6.3, and users are advised to update to version 2.2.6.4 or later.

For the Relion 670 series version 2.2.5.6, the Relion 650 series version 2.2.5.6, and the SAM 600 IO series version 2.2.5.6, the flaw has been resolved in version 2.2.5.7, with updates recommended to version 2.2.5.8 or later. For the Relion 670 series (version 2.2.4.4) and the Relion 650 series (version 2.2.4), users should update to version 2.2.4.5 or later for all affected products. Hitachi Energy also recommends applying the general mitigation measures provided.

CISA encouraged asset owners, administrators, and security teams to review the advisories in full, apply vendor-issued patches, and adopt layered defense measures to safeguard against potential exploitation. While the agency said it has not observed active exploitation of the vulnerabilities, it emphasized that attackers continue to target operational technology systems in ongoing campaigns against critical infrastructure.

The latest advisories reflect a persistent trend of recurring security flaws across the industrial technology ecosystem. In operational technology, these updates are a reminder that vulnerabilities persist and that patching challenges, legacy systems, and operational risks must be factored into defense strategies.

Just last week, CISA released nine ICS advisories addressing cybersecurity vulnerabilities and risks for asset owners and operators across the critical infrastructure sector. The advisories cover urgent vulnerabilities in hardware and software, including CPU modules from Mitsubishi Electric, remote terminal units from Schneider Electric, CNC tools and communications from Delta Electronics, SCADA (supervisory control and data acquisition) platforms from GE Vernova, and various Mitsubishi FA tools and protection relay systems from Hitachi Energy.

Source: CISA advisories detail ICS flaws in Delta, Fuji Electric, SunPower, Hitachi Energy hardware; provide mitigation
Contact
CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount disruptive cyberattacks. These threats target vulnerable operational technology (OT) and legacy components, often exploiting weak authentication and edge devices.

Key vulnerabilities and Risks
- Targeted infrastructure: increased cyber threats target renewable energy systems, such as solar and wind installations, and electricity grid management devices that help operate and monitor the power grid.
- Prepositioning attacks—such as Chinese state‑sponsored access (e.g., Volt Typhoon)—have compromised IT networks to enable future disciples.
- About 75% of transmission lines are over 25 years old. These systems often run unsupported software and lack modern security.
- Common attack vectors: attackers exploit weak passwords, a lack of multifactor authentication (MFA), and internet-facing OT devices.
- Specific threats, column, malware capabilities, inflow, targeting remote units (RTUs), and breaking industrial control system (ICS) protocols to degrade reliability
Mitigation And Actionable Advice

CISA encourages organizations to take immediate action:
- Enhance authentication: implement strict MFA, and eliminate default credentials.
- Ensure control systems are not directly accessible from the internet. Remove unnecessary network exposure.
- Monitoring column: Implement continuous monitoring programs to detect anomalies as highlighted on the CISA ICS web page.
- Review advisories: organizations should review specific advisories, such as the Superpower Sun Power PVS 6 device vulnerability (CVE 2025-9696).
The US Cybersecurity and Infrastructure Security Agency (CISA) published four new advisories on industrial control systems on Tuesday. These advisories detail vulnerabilities in equipment from Delta Electronics, Fuji Electric, Sun Power, and Hitachi Energy. The agency said these advisories provide essential technical information and mitigation guidance for asset owners and operators across the critical infrastructure sector.

The advisory covering Delta Electronics points to an improper restriction of XML external entity reference vulnerability in the company's EIP Builder, an engineering tool used to build and manage Ethernet/IP networks. Successful exploitation of this vulnerability could allow an attacker to potentially process dangerous external entities, resulting in the disclosure of sensitive information.

Deployed in the global critical manufacturing sector, CISA noted that the affected product is vulnerable to an XML external entity vulnerability, which could allow an attacker to disclose sensitive information. The vulnerability is tracked as CSCVE 2025.577704. It carries a CVSS v3.1 base score of 5.5. The updated CVSS v4 rating is 6.7.

KIMIYA, together with the Trend Micro Zero Day Initiative, reported this vulnerability to CISA. Delta Electronics recommends users update to V1.12 CISA 1. Attackers with network access could exploit the flaw to change configurations or disrupt operations. The company urges operators to apply security updates and recommended hardening steps.

A second advisory highlighted vulnerabilities in Fuji Electric’s FRENIC Loader 4 software, which is used with the company’s variable frequency drives. The flaws could allow arbitrary code execution or unauthorized system access, potentially enabling control hijacking or the forced shutdown of industrial processes. Fuji Electric’s FRE NIC Loader 4 is affected in versions earlier than 1.4.0.1.

Deployed across commercial facilities, the advisory identified that the affected product is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-969365. It has a CVSS v3.1 base score of 7.8, and in CVSS v4, the score rises to 8.4.

Kimiya also reported this vulnerability to CISA. Fuji Electric recommends users update to V1.1.4.0.1. CISA also disclosed weaknesses in SunPower's PVS6 device. The device aggregates data from photovoltaic systems and sends it to monitoring platforms. According to CISA, the flaws could compromise visibility into solar assets. They may also allow broader disruption across renewable energy environments.

The advisory added that successful exploitation of this vulnerability could allow attackers full access to the device, enabling them to replace firmware (the device's permanent software), modify settings, disable the device, create secure shell (SSH) tunnels for remote access, and manipulate attached devices.

The SunPower PVS 6's Bluetooth Low Energy (LE) SAR interface is vulnerable due to its use of hard-coded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows actions such as replacing the firmware (the permanent controlling software), disabling power production, changing grid settings, creating SSH (secure shell) tunnels for remote access, altering firewall settings, and manipulating connected devices. The vulnerability is tracked as CVE-2025-9696. It has a CVSS (Common Vulnerability Scoring System) v3.1 base score of 9.6, while the CVSS v4 score is 9.4.

Deployed across the global energy sector, Dagan and Henderson reported this vulnerability to CISA. However, SunPower did not respond to two CISS attempts to coordinate on these vulnerabilities. The last CISA ICS advisory updates a previous notice on Hitachi Energy’s Real Relion 670 and 650 series protection relays and SAM 600 IO modules. These systems are crucial for substation operations and high-voltage grid protection. The updated advisory gives more technical information and new mitigation strategies for power-sector operators.tors.

Hitachi Energy confirmed that multiple product lines are affected. The Relion 650 is impacted in versions 2.2.4.4 and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.6.2. The Relion 672 is affected in versions 2.2.2.6, 2.2.3.7, 2.2.4.4, and 2.2.5.6, as well as all versions from 2.2.6.0 to 2.2.2.6.2. Additionally, the SAM 600 IO is vulnerable in version 2.2.5.6.

Deployed across the energy sector, CISA identified a denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanisms in the Relion 670/650 and SAM 600 I/O series devices, which, if exploited, could cause critical functions, such as the LDC (line distance communication module), to malfunction. The vulnerability is tracked as CVE-2025-2403. It has a CVSS v3.1 base score of 7.5, while the CVSS v4 score is 8.7.

Hitar G Energy PSIRT reported this vulnerability to CISA. Hitachi Energy outlined several specific workarounds and motivations to reduce risk for the Relion 670 series, version 2.2.6 revisions up to 2.2.6.2, and the Relion 650 series, version 2.2.6 revisions up to 2.2.6.2. The issue has been fixed in version 2.2.6.3, and users are advised to update to version 2.2.6.4 or later.

For the Relion 670 series version 2.2.5.6, the Relion 650 series version 2.2.5.6, and the SAM 600 IO series version 2.2.5.6, the flaw has been resolved in version 2.2.5.7, with updates recommended to version 2.2.5.8 or later. For the Relion 670 series (version 2.2.4.4) and the Relion 650 series (version 2.2.4), users should update to version 2.2.4.5 or later for all affected products. Hitachi Energy also recommends applying the general mitigation measures provided.

CISA encouraged asset owners, administrators, and security teams to review the advisories in full, apply vendor-issued patches, and adopt layered defense measures to safeguard against potential exploitation. While the agency said it has not observed active exploitation of the vulnerabilities, it emphasized that attackers continue to target operational technology systems in ongoing campaigns against critical infrastructure.

The latest advisories reflect a persistent trend of recurring security flaws across the industrial technology ecosystem. In operational technology, these updates are a reminder that vulnerabilities persist and that patching challenges, legacy systems, and operational risks must be factored into defense strategies.

Just last week, CISA released nine ICS advisories addressing cybersecurity vulnerabilities and risks for asset owners and operators across the critical infrastructure sector. The advisories cover urgent vulnerabilities in hardware and software, including CPU modules from Mitsubishi Electric, remote terminal units from Schneider Electric, CNC tools and communications from Delta Electronics, SCADA (supervisory control and data acquisition) platforms from GE Vernova, and various Mitsubishi FA tools and protection relay systems from Hitachi Energy.

Source: CISA advisories detail ICS flaws in Delta, Fuji Electric, SunPower, Hitachi Energy hardware; provide mitigation

CISA Warns of Vulnerability in US Power Grid Systems

Harish Shenoy
April 7, 2026
11 min read
163

CISA and intelligence partners have warned that non-state actors, particularly those from China, are pre-positioning themselves within U.S. critical infrastructure, including power grid systems, to mount... Details

FBI Flags Cyber Incident Involving Surveillance Systems

Harish Shenoy
April 7, 2026
6 min read
179

FBI Cyber relentlessly targets cyber attackers by leveraging unique authorities, advanced capabilities, and strong partnerships. Hijacked networks, cryptocurrency theft, and corporate espionage highlight the growing cyber threat. Each... Details

Meta Shifts Messaging Toward Integrated AI Platforms

Harish Shenoy
April 7, 2026
6 min read
202

Meta has changed its strategy, moving away from separate social networking apps and focusing on building deeply integrated, automated communication platforms. The change, which accelerated in early 2026,... Details

Amazon Patent Shows Gesture-Based Control for Devices

Harish Shenoy
April 7, 2026
5 min read
161

Amazon holds several patents for gesture-based control systems in devices such as drones, wearables, and home entertainment products. Technologies intend to make it easier to interact with... Details

Google Cuts a Memory Cost With New TurboQuant Method

Harish Shenoy
April 6, 2026
10 min read
210

Vectors are the basic tools AI models use to process information. Simple vectors describe points while high-dimensional embeddings capture complex details, dash-like features of an embedding image,... Details

Microsoft 365 E7 Adds Control Layer for Enterprise AI Agents

Harish Shenoy
April 6, 2026
10 min read
196

Today, we introduced the next step in bringing frontier transformation to life for customers in every industry with Wave 3 of Microsoft 365 Copilot, Microsoft... Details

OpenAI acquires TBPN to expand AI Media Reach

Harish Shenoy
April 6, 2026
3 min read
220

We are excited to acquire TBPN, a team known for editorial talent, audience insight, and strong culture. TPPN is a place for real conversations about AI and its... Details

Intellia Expands Hiring Push for AI-Driven Gene Editing

Harish Shenoy
April 6, 2026
9 min read
220

Intellia Therapeutics is growing its team to accelerate the development of AI-powered and advanced gene-modification technologies. The goal is to strengthen its standing as a leader... Details

Planet Limits Satellite Data Access Under US Request

Harish Shenoy
April 6, 2026
4 min read
212

Planet Labs will stop delivering high-resolution satellite images of Iran and other conflict areas at the request of the US government. On March 9, 2026,... Details

Prev.
1
…
115
116
117
118
119
…
187
Next

Latest post

Which 12 Mobile Apps Just Won Apple’s Grand Design Awards

When Can You Grab Huge 50% Off Deals For Prime Day?

How Can Your Home TV Stream 104 Soccer Matches This Summer?

Popular Posts

Best Budget Smartphones 2026: Affordable Phones That Impress (4125)

Best Business Laptops 2025 (3736)

The Future Is Calling: Top Upcoming Smartphones of 2026 You’ll Want to Wait For (3158)

DSLR vs Mirrorless: Which Is Better for Photography Beginners? (2535)

NIST Update Signals Fast Track for Post-Quantum Standards (2322)

Stay Connected

Category: News