CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

[Control systems] CISA ICS security advisories (AV26–241) – Update 1

unknownknown exploitedpublic exploitCVE-2025-67038
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Serial number: AV26-241 Date: March 16, 2026 Updated: June 23, 2026 Between March 9 and 15, 2026, CISA published ICS advisories to address vulnerabilities in the following products: Apeman Cameras ID71 – all versions Ceragon Siklu MultiHaul and EtherHaul Series – multiple versions Honeywell IQ4x BMS Controller – multiple versions and models Inductive Automation Ignition Software – versions prior to 8.3.0 Lantronix EDS3000PS – version 3.1.0.0R2 Lantronix EDS5000 – version 2.1.0.0R3 Siemens Heliox EV Chargers – version Heliox Mobile DC 40 kW EV Charging Station Siemens Heliox EV Chargers – version Heliox Flex 180 kW EV Charging Station Siemens RUGGEDCOM APE1808 Devices – all versions Siemens SIDIS Prime – versions prior to V4.0.800 Siemens SIMATIC – multiple versions and models Trane Tracer Concierge – versions prior to v6.3.2310 Trane Tracer SC – versions prior to v4.4_SP7 Trane Tracer SC+ – versions prior to v6.3.2310 Update 1 On June 23, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-67038 affecting Lantronix EDS5000 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available. CISA ICS Advisories CISA KEV: CVE-2025-67038

CSIRTS triage

Other
What
This advisory covers vulnerabilities in various control systems and devices.
Who is affected
Multiple control systems and devices from various manufacturers are affected.
Urgency
Remediation is necessary as exploitation is known and vulnerabilities exist.
Action
Review and apply necessary updates for affected devices.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source
Canadian Centre for Cyber Security (CA · national-cert · site)
Severity
unknown
Published
2026-06-23
Exploitation
Observed in the wild (CISA KEV)

Original advisory: https://cyber.gc.ca/en/alerts-advisories/control-systems-cisa-ics-security-advisories-av26-241

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2025-67038coverage & exploitation statusNVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

More from Canadian Centre for Cyber Security