Editorial

Two findings dominate this week. The first affects Ignition from Inductive Automation: a valid Vision project session can be used to obtain Designer privileges and execute code within the Gateway process. The second concerns scale: Siemens’ monthly bulletin covers 746 CVEs, 40 of them critical, across an extensive portfolio of industrial products. One finding calls for reviewing permissions and trust between modules; the other requires cross-checking the advisory against the actual asset inventory. If your plant uses Ignition or SIMATIC equipment covered by the October advisories, version verification should begin now.

Vulnerabilities of the Week

[HIGH] A Vision session can escalate to Designer privileges in Ignition

Ignition’s Perspective module (Inductive Automation) does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project can submit a valid session identifier and obtain Designer privileges. With those privileges, the user can execute arbitrary code in the context of the Gateway process. This finding is relevant to industrial environments because the Ignition Gateway often has direct connectivity to PLCs and field equipment. In our experience, Ignition frequently appears in Mexican industrial facilities involved in discrete manufacturing and continuous processes, particularly as a supervisory layer over OT networks. The attack vector is network-based and requires low privileges. CVSS 3.1: 8.8 (HIGH). (CVE-2026-92817)

View full advisory →

Suggested action: Update to Ignition 8.3.9 or 8.1.55, depending on the branch in use. Review which users can initiate Vision sessions, validate role assignments, and prevent the Gateway from accessing OT segments beyond those strictly necessary.

Every update must first be validated with the manufacturer, tested in a controlled environment, and implemented in accordance with the organization’s change management process and maintenance windows.

[HIGH] WAGO PFC100/PFC200 and Edge Controller: command injection and unauthorized PROFIBUS changes through WBM

Two vulnerabilities in the Web-Based Management (WBM) interface of WAGO CC100, PFC100 G2, PFC200 G2, TP600, Edge Controller, and WP400 devices affect firmware versions earlier than 4.10.0. The first (CVE-2026-80466, CVSS 8.8) allows a low-privileged remote user to inject shell commands into routing configuration parameters. The values are stored in a configuration file and subsequently processed by a helper script with root privileges, turning operator access into command execution as root. The second (CVE-2026-88850, CVSS 8.1) allows the same type of user to modify protected PROFIBUS parameters, including device addressing and SSA configuration, without the required authorization. The combination of both vulnerabilities in an environment with active PROFIBUS represents a direct operational risk. In our experience, WAGO PFC PLCs and controllers frequently appear in Mexican manufacturing and energy facilities, particularly in automation cells with Ethernet-PROFIBUS connectivity. (CVE-2026-80466, CVE-2026-88850)

View full advisory →

Suggested action: Update the firmware of affected WAGO devices to version 4.10.0 (FW32) or later. While the update is being carried out, restrict WBM access to authorized network segments and engineering workstations. Also verify that operator profiles cannot access the management interface from the general OT network.

Every update must first be validated with the manufacturer, tested in a controlled environment, and implemented in accordance with the organization’s change management process and maintenance windows.

[HIGH] MicroSCADA X SYS600: local privilege escalation and unauthorized access to application objects

Hitachi Energy reported three vulnerabilities in MicroSCADA X SYS600. CVE-2026-9854 allows a user with access to the engineering tools to elevate their privileges to administrator level on the Windows host; it affects versions 10.0 through 10.7. CVE-2026-9853 allows any user authenticated to the server’s operating system to read or modify SYS600 application objects without authenticating to the SCADA system; this vulnerability also affects version 10.8. CVE-2026-9852 is a formula injection vulnerability in exported CSV files that can modify or exfiltrate data and, depending on the configuration of the user’s computer, execute code; it affects versions 10.0 through 10.7. The first two have a CVSS 3.1 score of 7.8. The report was coordinated by Sandia National Laboratories’ CyTRICS program. In our experience, MicroSCADA frequently appears in Mexican power generation, transmission, and distribution facilities. (CVE-2026-9852, CVE-2026-9853, CVE-2026-9854)

View full advisory →

Suggested action: For installations running versions 10.0 through 10.7, update to MicroSCADA X SYS600 10.8. This update fixes CVE-2026-9852 and CVE-2026-9854, but version 10.8 remains affected by CVE-2026-9853. For that attack vector, apply the mitigation strategy specified by Hitachi Energy in section 2.1.7.5 of the installation manual. Review operating system account permissions, limit access to engineering tools, and restrict logins to the server hosting SYS600.

Every update must first be validated with the manufacturer, tested in a controlled environment, and implemented in accordance with the organization’s change management process and maintenance windows.

[HIGH] Moxa AIG-302 ThingsPro Edge: hard-coded cryptographic key in a system binary

The Moxa AIG-302 ThingsPro Edge industrial gateway, versions 1.0.0 through 1.4.0, contains a hard-coded private cryptographic key in the `/usr/bin/sysman` binary (CVE-2026-109813, CVSS 4.0: 8.6). An unauthenticated attacker with access to the adjacent network can extract this cryptographic material and use it to compromise information protected by the device. The second vulnerability (CVE-2026-109812, CVSS 4.0: 6.9) allows an authenticated user with low privileges to access sensitive information through the `/api/v1/secrets/` API due to insufficient authorization checks. Both attack vectors require access to an adjacent network, so segmentation directly reduces the attack surface while the fix is being applied. In our field experience, Moxa AIG gateways frequently serve as integration points between OT networks and cloud platforms or MES systems. (CVE-2026-109812, CVE-2026-109813)

View full advisory →

Suggested action: Update ThingsPro Edge on the AIG-302 to version 1.4.1 through the web console, under `Maintenance > Software Upgrades`. After updating, rotate any credentials, certificates, and keys that were stored or managed by the device during the exposure period. Limit network access to the gateway to strictly necessary systems.

Every update must first be validated with the manufacturer, tested in a controlled environment, and implemented in accordance with the organization’s change management process and maintenance windows.

In Brief

• Siemens publishes its October monthly bulletin covering 746 CVEs, 40 of them critical. The GNU/Linux components of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP and S7-1500 TM MFP account for a significant portion of the total. Separately, the S7-1500 family’s web server has three critical vulnerabilities associated with importing manipulated trace files (CVE-2026-63350, CVE-2026-63353, and CVE-2026-63354). An attacker must persuade an authorized user to import the file; exploitation can execute JavaScript in that user’s session and perform operations on the PLC within that account’s permissions. Siemens does not yet offer a fix for several affected products and recommends applying the mitigations in advisory SSA-591731. (Bulletins published on October 13, 2026)
• Schneider Electric SAGE RTU 1410–4400 has an insufficient firmware authenticity verification vulnerability (CVE-2026-102250, HIGH). An administrator with valid credentials can upload modified firmware during an update and alter the device’s behavior. Update to C3414-500-S02L0. (INCIBE-2026-729)
• Rockwell Automation 1732E ArmorBlock I/O has two high-severity vulnerabilities: an authentication bypass through replay of captured communications (CVE-2026-12655) and a denial-of-service condition caused by a traffic storm (CVE-2026-12656). The first allows the web server password to be changed without valid credentials; the second can disrupt communications and require a power cycle to recover the device. Update the firmware to version 3.013. (INCIBE-2026-734)
• Eclipse Milo (OPC UA) has several vulnerabilities in versions up to 1.1.4. The most severe (CVE-2026-60007, CVSS 4.0: 9.1) allows a network-positioned attacker to recover passwords through a padding oracle targeting tokens encrypted with Basic128Rsa15. If your organization uses Milo-based OPC UA implementations, migrate to version 1.1.5. The 0.6.x branches will not receive a fix. (ICSA-26-288-01, INCIBE-2026-750)
• Hitachi Energy RTU500 has nine CVEs affecting CMU-series firmware. The most severe (CVE-2026-6653, CVSS 8.8) is a use-after-free vulnerability in libxml2 that may allow remote code execution with low privileges. The RTU500 family is widely used for substation telecontrol. Update to firmware version 13.9.1 or a later version compatible with the device. (ICSA-26-293-05)

Closing Thoughts

This week’s priorities are not determined solely by the number of CVEs. Ignition shows how a valid session can turn into control of the Gateway; WAGO and MicroSCADA demonstrate the impact of poorly defined permissions within administration and engineering tools; Moxa reminds us that secrets embedded in a device must be considered compromised until they are updated and rotated.

The immediate action is to cross-check product, version, and access path. Identify Ignition Gateways, review who can initiate Vision sessions, locate WAGO controllers with accessible WBM interfaces, confirm the version of each SYS600 server, and look for AIG-302 gateways. Then prioritize based on each asset’s actual connectivity and its ability to modify the process.

The analysis and prioritization expressed in Perímetro are the editorial responsibility of Roberto Manzo. This newsletter is not a substitute for technical advice specific to your organization.