A chained exploit comprising three zero-day vulnerabilities in Siemens ROX II OT switches allows an attacker to escalate from arbitrary file disclosure to full persistent root-level access. CVE-2025-40948 leverages a root-privileged xz utility to read any file on the filesystem, CVE-2025-40947 exploits unsanitized input in the feature key signature verification to achieve command injection as root, and CVE-2025-40949 enables persistent code execution by injecting commands into the root cron table via the web management task scheduler. Siemens has released firmware V2.17.1 to address all three vulnerabilities.
OT Security
7 posts
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy Threat landscape for industrial automation systems. Q1 2026 Kaspersky's Q1 2026 ICS threat landscape report indicates a continued overall decline in malware blocked on industrial automation systems, reaching 19.6%. However, specific regions like Southern Europe and industries like biometric systems saw notable increases in threats, particularly from malicious scripts, phishing, and spyware. The report highlights the persistent risk to OT environments from common threat vectors like internet browsing and email.
2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface The 2026 FIFA World Cup presents a massive, multi-jurisdictional attack surface threatened by state-nexus disruptive operations and financially motivated cybercrime. Key risks include Iran-aligned actors targeting municipal OT infrastructure, pro-Russian hacktivists launching high-volume DDoS attacks against tournament services, and cybercriminals deploying ransomware against the hospitality supply chain.
Intelligence Center State-sponsored threat actors operate with a fundamentally different methodology than financially motivated criminals, prioritizing long-term stealth over immediate disruption. By leveraging valid credentials and living-off-the-land (LOTL) techniques such as PowerShell and WMI, these adversaries bypass traditional signature-based detections. Defending against and responding to these threats requires organizations to shift toward continuous behavioral baselines, enhanced telemetry (e.g., Event IDs 4688, 4104, Sysmon), and strategic incident response plans that account for complex containment decisions and supply chain risks.
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure Iranian-affiliated APT actors are actively targeting internet-exposed programmable logic controllers (PLCs), specifically Rockwell Automation devices, across multiple U.S. critical infrastructure sectors. The attackers utilize native configuration software and Dropbear SSH to manipulate project files and HMI displays, leading to operational disruptions and financial losses.
Falcon Platform for Government Now Offers Falcon for XIoT to Secure Connected Assets CrowdStrike has expanded its FedRAMP High authorized Falcon Platform for Government to include Falcon for XIoT, providing federal agencies with unified visibility, AI-powered risk prioritization, and threat detection across converged IT and OT environments.
Why East-West Visibility Matters for Grid Security The convergence of IT and OT in electric grid infrastructure has increased the risk of lateral movement by adversaries. To protect critical operations and comply with regulations like NERC-CIP-15, organizations must implement deep east-west network visibility capable of understanding specialized industrial protocols.
