Two critical flaws in lwIP expose an OT inventory blind spot
Two vulnerabilities in lwIP highlight embedded dependencies that rarely appear in OT inventories. This edition also reviews critical flaws in Siemens Industrial Edge Management and Siveillance Control, as well as relevant vulnerabilities in ABB and Lenze products.
Editorial
Two vulnerabilities in lwIP, a TCP/IP stack used in numerous embedded systems, are the focus this week. One of them reaches a CVSS v3.1 score of 9.8 and could allow code execution on devices incorporating the affected MQTT client. The operational challenge is clear: lwIP often resides within firmware and rarely appears as an independent component in OT inventories.
Added to this are a critical authentication bypass in Siemens Industrial Edge Management, an arbitrary file upload in Siveillance Control, and significant findings in ABB and Lenze products. The priority for this edition is to identify which assets incorporate vulnerable components and confirm with each manufacturer whether patched firmware is available.
Vulnerabilities of the week
[CRITICAL] Remote code execution in the lwIP MQTT client
lwIP is a TCP/IP stack designed for embedded systems and used in products across sectors such as energy, critical manufacturing, water, transportation, and communications. Versions 2.0.1 through 2.2.1 of its MQTT client contain an out-of-bounds write that could allow a remote attacker, without credentials or user interaction, to execute code on the device. The vulnerability reaches a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3.
The risk does not depend solely on whether a device “uses MQTT.” It is necessary to confirm that the firmware incorporates an affected version of the lwIP MQTT client and that there is an attack path to that component. In the field, this type of dependency can appear in IoT gateways, communication modules, and automation equipment without being recorded in the asset inventory.
(CVE-2026-87121)
Suggested action: Request the firmware composition or SBOM from manufacturers and confirm if each model incorporates the lwIP MQTT client 2.0.1–2.2.1. Prioritize assets accessible from untrusted segments or those connecting to MQTT infrastructure outside the OT perimeter. Apply a manufacturer-validated firmware version that includes the fix for the commit: f89407ea711879c04d91c92b35d67be78bbaf0f1. If an update is not yet available, restrict connectivity to the affected service and document a temporary exception with monitoring.
All updates must be validated with the manufacturer, tested in a controlled environment, and executed in accordance with the organization’s change management process and maintenance windows.
[CRITICAL] Siemens IEM allows account takeover via password recovery flow
A flaw in the Keycloak credential recovery flow allows an unauthenticated remote attacker to force a password reset for any user without completing email verification. This can result in a full account takeover. The vulnerability reaches a CVSS v3.1 score of 9.1.
It affects Industrial Edge Management Cloud in all versions; IEM Pro V1 from 1.14.9 and earlier than 1.15.20; IEM Pro V2 from 2.2.0 and earlier than 2.2.2; and IEM Virtual from 2.6.0 and earlier than 2.9.1. Siemens mitigated the Cloud variant with firewall rules on August 26 and patched it on September 2, 2026, with no action required by the customer. The Pro and Virtual variants require an update.
(CVE-2026-18963)
Suggested action: Verify your installed version and update IEM Pro V1 to 1.15.20 or later, IEM Pro V2 to 2.2.2 or later, and IEM Virtual to 2.9.1 or later. Until the update is complete, block direct access from the internet. As a temporary measure, configure a WAF or reverse proxy to block `/auth/realms/customer/login-actions/reset-credentials`, or disable the password recovery feature in Keycloak. Note that both measures will disable password resets.
All updates must be validated with the manufacturer, tested in a controlled environment, and executed in accordance with the organization’s change management process and maintenance windows..
[CRITICAL] Arbitrary file upload with root access in Siemens Siveillance Control
The OIS web module for Siveillance Control and Siveillance Control Pro allows an attacker on an adjacent network with low privileges to upload arbitrary files to the server. Exploitation can grant root access and fully compromise the OIS environment. The vulnerability has a CVSS v3.1 score of 9.0 and a CVSS v4.0 score of 8.9.
Siveillance Control integrates physical security systems such as access control, intrusion detection, and video surveillance. In critical installations, a server compromise can facilitate lateral movement to other connected systems.
(CVE-2026-50093)
Suggested action: Update Siveillance Control V3.0 to 3.0.22.2177 or later and V4.0 to 4.0.11.2177 or later. For Control Pro, update V3.0 to 3.0.12.2173 or later and V4.0 to 4.0.9.2178 or later. While completing the update, restrict access to the OIS server to authorized administrative stations and review file upload logs.
All updates must be validated with the manufacturer, tested in a controlled environment, and executed in accordance with the organization’s change management process and maintenance windows.
[HIGH] Three vulnerabilities in ABB products: RCE, DoS, and privilege escalation
INCIBE-CERT reports three high-severity vulnerabilities in ABB products used in industrial automation. CVE-2025-41700 affects Automation Builder versions prior to 2.9.1: a manipulated project file can execute code in the user’s context when opened. CVE-2025-41738 affects AC500 V3 firmware prior to 3.9.1: a manipulated request to the visualization web server can cause a denial of service. CVE-2026-15952 affects PCM600 2.14 and earlier versions: incorrect permissions in the Scheduler service, running as LocalSystem, allow a local user with limited access to escalate privileges.
Automation Builder and AC500 V3 are present in manufacturing and energy environments; PCM600 is widely used in engineering and protection relay maintenance. No active exploitation of these three CVEs had been reported at the time of publication.
(CVE-2025-41700, CVE-2025-41738, CVE-2026-15952)
Suggested action: Update Automation Builder to 2.9.1 and confirm that the AC500 V3 firmware is at 3.9.1. For PCM600, apply the mitigation published by ABB: configure the ABBPCMSchedulerService to run with the same Windows account used by PCM600 and validate that it has the Log on as a servicepermission. Review the manufacturer’s advisory before implementing the change.
All updates must be validated with the manufacturer, tested in a controlled environment, and executed in accordance with the organization’s change management process and maintenance windows.
In brief
- lwIP, core API: a double-free memory vulnerability in lwIP 2.0.1–2.2.1 can cause system crashes, memory corruption, or code execution. The fix is included in commit f873b6295933e4149a2132adf3e9a2d2a676a5ec; Request validated firmware from the equipment manufacturer. (CVE-2026-91018 / ICSA-26-265-02)
- Siemens Desigo CC V6 and V7: specially crafted graphic documents can execute code on ClickOnce or installed clients. There is no fix for V6 or V7; V8 and V9 are not affected. Limit Graphics application configuration permissions by following the principle of least privilege. (CVE-2026-34223 / ICSA-26-265-05)
- Siemens SIMOVE Fleetmanager and SIPLANT: a path traversal vulnerability allows an unauthenticated remote attacker to read arbitrary files, including credential stores, private keys, and configuration secrets. Update SIMOVE to the corresponding patched version. SIPLANT V1.7, V2.2, and V3.0 require contacting support; SIPLANT V3.1 must be updated to 3.1.4 or later. (CVE-2026-67367 / ICSA-26-265-07)
- Lenze VPN Client prior to 1.4.7: a CRLF injection allows for command execution as root or SYSTEM. The manipulated configuration persists after restarting the client or the operating system. Exploitation requires user interaction. The Lenze cloud environment blocks connections from vulnerable versions; update to 1.4.7. (CVE-2026-75925 / VDE-2026-089)
- Siemens Mendix Runtime: the advisory has been revoked. Further investigation determined that the reported behavior corresponds to the platform’s expected configuration and does not expose the protected attribute. CVE-2026-7891 has been rejected. No remediation is required for this CVE; tickets or alerts created specifically for it should be closed. (ICSA-26-209-02 Update A)
Closing thoughts
The most important takeaway from this edition is not just the CVSS 9.8 score. It is the difficulty in answering a basic question: which plant devices incorporate lwIP, and in what version?
Embedded dependencies rarely appear with sufficient detail in a traditional OT inventory. Resolving this blind spot requires requesting information from the manufacturer, maintaining SBOMs when available, and mapping each component to the exact model and firmware version deployed. If the answer today is “we need to check,” this is a good time to start that inventory.
The analysis and prioritization expressed in Perímetro are the editorial responsibility of Roberto Manzo. This publication does not replace technical advice specific to your organization..