30 MLB teams, 30 players to fade at their fantasy baseball ADPs

The following players are overvalued compared to ADP — not necessarily “busts” as they can still retain value. Go here for sleepers.

Marte now carries a top-30 ADP after coming off a career best season, so proceed with caution. He hasn’t reached double-digit stolen bases since 2019 (when he had 10), and he’s missed an average of 34 games over the last four seasons. Marte was legitimately awesome in 2024, posting a 151 wRC+ that ranked top 10 in baseball. But he owns a career 118 wRC+, and OOPSY projects Marte to come back down to 25 home runs in 2025 (over an optimistic 147 games played).

Marte is due for regression at the plate, and he doesn’t run much. His Yahoo ADP was outside 100 in 2024, and he’ll now be 31 years old. Fade Marte’s ADP.

The A’s aren’t loaded with players with high ADPs, and the change in venues will be favorable for their hitters. Mason Miller’s new ADP is risky given his injury history, but he also might be the most exciting pitcher in all of baseball right now (and he easily led all relievers in K-BB% last season). Enter Severino, who’s the Athletics’ new ace and highest drafted SP. He posted a 2.96 ERA and a 1.19 WHIP at home last season but a 5.00 ERA and a 1.30 WHIP when not in the extremely pitcher-friendly Citi Field.  

[Join or create a Yahoo Fantasy Baseball league for the 2025 MLB season]

Severino now will be pitching in a smaller park and in warmer weather with the move to Sacramento (where the A’s will share parks with the Giants’ Triple-A affiliates). There are better late-round fliers for those searching for SP help in deeper leagues.

Acuña is set to miss the first 4-6 weeks of the season while recovering from his second ACL surgery. He’s reportedly looked great at the plate during Atlanta’s camp, but fantasy managers should be concerned about Acuña openly stating he plans on “taking it easy” on the base paths after returning. Atlanta is trying to avoid Acuña having to deal with lingering discomfort that followed him throughout the 2022 season following his first ACL procedure, when he posted a 115 wRC+. Acuña was also quietly pedestrian over 50 games at the plate (105 wRC+) before suffering his knee injury last season.

[Join or create a Yahoo Fantasy Baseball league for the 2025 MLB season]

Most projection systems remain extremely bullish, calling for 35+ steals over 120ish games. Other systems manually changed after Acuña’s quote painted a more pessimistic outcome.

Acuña is one season removed from going 40/70, so there’s obvious upside, but there’s real risk of him running significantly less in 2025. He’s a fade as a borderline top-30 pick in Yahoo drafts

Eflin has benefitted greatly from pitching at Tropicana Field over the last two years, including posting a 1.94 ERA and a 0.92 WHIP there last season. He recorded a 4.33 ERA and a 1.25 WHIP outside of pitcher-friendly Tampa Bay. Tropicana Field has increased strikeouts by 8% over the last three seasons, while Oriole Park has decreased Ks by 8% over that span. Baltimore is also moving in its left-field fences in 2025, so Eflin will have a full season in a tougher environment.

Gunnar Henderson also carries some risk given his high ADP (7.7), modest SB projections, second half drop in production and entering the season with an intercostal injury. 

Hendriks has struggled this spring while competing to be Boston’s closer. Aroldis Chapman has had control issues, but he’s striking batters out and was a top 10 reliever after the All-Star break last season. Justin Slaten and Garrett Whitlock are also capable options of securing the Red Sox’s closer’s role. Hendriks’ last productive season was back in 2022, and his previous velocity looks unlikely to return.

Suzuki owns a legit 129 wRC+ over three years in the majors, but he’s also missed an average of 35 games each season. He’ll turn 31 years old this summer, and Suzuki’s batting average is at risk of falling in 2025. His .282 BA last year came with a .255 expected BA, which was one of the biggest differences in MLB. Suzuki’s .370 BABIP was the highest in baseball, and it also would’ve led the league in 2022 and 2023, which is especially surprising for a right-handed corner outfielder who usually puts balls in the air

Suzuki is being drafted next to Luis Robert Jr. in Yahoo leagues, but the latter’s projections are dramatically better

A depleted White Sox roster gives few options here, and it also hurts Vaughn’s counting stats. He managed just 55 runs scored and 70 RBI over 619 plate appearances last season. Vaughn is a fine floor pick if you need to fill first base, but he’s never reached 70 runs scored or surpassed 80 RBI or 21 homers during his career. Vaughn has three career stolen bases. Chicago’s lineup could become even uglier if/when Luis Robert Jr. gets traded. The White Sox are projected to once again score the fewest runs in baseball in 2025.

Díaz’s 4.48 SIERA ranked 156th out of 169 qualified relievers last season. He pitches in one of baseball’s most extreme hitter’s parks in Cincinnati, where Díaz recorded a 4.61 ERA and a 1.50 WHIP last year. Díaz’s K% dropped from 31% over 2022-23 down to 22.7% last season, and his abnormally low BABIP (.250) and HR/FB% (8.6) are especially likely to regress while pitching in Great American Smallpark. There are no obvious replacements for the closer’s role, but the Reds signed Taylor Rogers and Scott Barlow during the offseason, when Emilio Pagán also lost 30 pounds, so there are alternatives.

Kwan can be a batting average help, but his ADP (141) is too high for an outfielder projected to go 8/17 with few RBI. Kwan’s Hard-Hit% and Bat Speed were both in the bottom one percentile last season, and his average exit velocity was in the bottom 10th. Kwan has a low fantasy ceiling, yet he’s being drafted in between Dylan Crews and Pete Crow-Armstrong in Yahoo leagues; two players with far more fantasy upside. Moreover, Jasson Domínguez shouldn’t be going after Kwan in fantasy drafts

Doyle will continue to benefit from hitting in Coors Field and possibly leadoff, but he carries some risk given his massive jump in ADP. Doyle is now a top 65 pick in NFBC leagues, and he’s going next to Lawrence Butler in Yahoo drafts. Doyle is one season removed from batting .203 (with a 45 wRC+!), and he hit just .211/.273/.364 over 280 ABs on the road last season. Doyle hit .167/.203/.212 (.415 OPS) in September, even with the benefit of Coors Field.

The bags and homers are very nice, but fade Doyle’s new ADP.

Foley enters the favorite to close in Detroit after racking up 28 saves last season, but he’s unlikely to keep the job. Foley throws hard, but it’s yet to translate into missing bats; his 18.4 K% ranked 151st out of 169 qualified relievers last year. His 4.09 SIERA ranked 138th. Foley appeared during just one of Detroit’s seven postseason games, and the Tigers handed the superior Tommy Kahnle a $7.75 million contract during the offseason. Fade Foley at draft tables.

Altuve is a rock-solid fantasy player, but a borderline third-round pick is too early. Altuve reached his most plate appearances (682) last year since 2016, yet it still resulted in relatively modest counting stats. The compiling helped his fantasy line, but Altuve showed signs of decline at the plate, which is more concerning entering his age-35 season. Altuve will also be learning a new position with his move to left field. THE BAT X projects Altuve to go .258-79-17-67-15, which would be a reach as a top 40 pick in Yahoo drafts.

Estévez has performed much better since leaving Coors Field, and he enters the season the favorite to close in Kansas City after signing with the Royals during the offseason. But he saw his K% drop last season, when his .229 BABIP was one of the lowest among all relievers. Estévez’s hit rate could massively regress now that he’s pitching in one of baseball’s most favorable hitter’s parks. Kauffman Stadium boosts batting average and walks while also decreasing strikeouts more than any other park. Meanwhile, Lucas Erceg emerged as an elite RP last season, so the Royals have an alternative just waiting for the opportunity.

O’Hoppe hit just .196/.266/.312 with a 64 wRC+ after the All-Star break last season, when his K% also skyrocketed to 38.2%. Injuries may have contributed, but O’Hoppe is now in danger of losing at-bats after the Angels signed Travis d’Arnaud during the offseason. D’Arnaud’s 105 wRC+ ranks 11th among all qualified catchers since 2022. O’Hoppe’s .244 BA came with a .318 BABIP that was 68 points higher than his 2023 hit rate. O’Hoppe is at risk of platooning far more in 2025, yet he’s being drafted next to J.T. Realmuto. 

Freeman absolutely could be a nice bounce-back candidate after a down 2024, but there’s also risk while remaining a top 20 pick in Yahoo leagues. The Dodgers will reportedly manage his ankle over the first half of the season after Freeman underwent offseason surgery. It could also lead to fewer stolen base attempts, especially considering his already notable declining speed. Freeman’s Bat Speed was in the 20th percentile last year, and he’ll turn 36 years old this season. Freeman has a nice floor as a BA help and hitting in the middle of a loaded lineup, but he hasn’t reached 30 homers since joining Los Angeles, and his SBs are at risk. Fade Freeman as a top 20 pick.

Faucher’s K rate spiked last season, but he owns a career 4.65 ERA as he enters 2025 the leading candidate to close in Miami. THE BAT projects Faucher to post a 4.35 ERA and a 1.43 WHIP. Jesús Tinoco recorded a 2.03 ERA with a 0.68 WHIP after joining the Marlins last season, while Anthony Bender has shown flashes of dominance while healthy, so Miami has alternatives.

Marlins relievers have all struggled this spring with no one emerging as the clear answer to close, but Faucher doesn’t look like the long-term solution. Miami is projected to win a lowly 62 games, so save opportunities will be scarce as well. 

Turang was one of fantasy’s biggest breakouts last year, but he offers little power and should regress in steals. Turang hit just .220/.277/.287 with a 58 wRC+ after the All-Star break last season. His Bat Speed and Barrel% both finished in the bottom 3% of MLB. Turang owns a career 76 wRC+ (that would’ve ranked third worst among 129 qualified hitters last year), so he’s destined to hit toward the bottom of Milwaukee’s lineup.

Turang’s projections are nearly identical to Victor Robles, who goes 100 picks later in Yahoo drafts

Trevor Megill is also a fantasy fade, as his K-BB% sunk all the way down to 10.0% while his FIP jumped to 4.51 after the All-Star break last season. The Brewers are loaded with potential ninth-inning replacements, highlighted by (but not limited to) future long-term closer, Craig Yoho

Lewis clearly has upside after posting a 154 wRC+ just one season ago, but the piling up of injuries have become hard to ignore. Lewis has missed an average of 92 games over the last two seasons thanks to a litany of health issues, and he also hit just .207 with a .620 OPS over his final 56 games last year. Lewis didn’t attempt a single stolen base in 2024. He’s plenty capable of bouncing back at the plate, but there are too many durability questions for Lewis to be worth a top 90 pick in Yahoo leagues

Vientos was a real nice power surprise last season, when he popped 27 homers over just 413 at-bats. But his K% jumped all the way to 33.7% in the second half after pitchers saw him more, and that K% would have ranked behind only Zack Gelof (who hit .211) over the full season. Vientos had the 12th-biggest negative difference in wOBA and xwOBA, and he hits in one of baseball’s most extreme pitcher’s parks. THE BAT X projects Vientos to hit .232 this season, yet he’s somehow being drafted right next to Junior Caminero in Yahoo leagues

Fried is a solid pitcher who’s being drafted like a borderline elite one despite now moving to Yankee Stadium. The overall Park Factors appear neutral when comparing Atlanta and New York, but some differences could affect Fried; Yankee Stadium has boosted home runs an AL-high 19% over the last three seasons. Moreover, Yankee Stadium has increased walks an MLB-high 10%, and Fried will be leaving a park in Atlanta that helped bump strikeouts by 9% (the third-most in MLB).

Fried’s 15.3 K-BB% ranked 32nd among 58 qualified starters last season, sandwiched between MacKenzie Gore and Brady Singer. His CSW was in between Charlie Morton and Kutter Crawford. Fried had as many strikeouts as Mitch Keller and fewer Ks than Tyler Glasnow, who pitched 40 fewer innings.

The 31-year-old Fried signed a massive offseason contract to join New York, and fantasy managers are also paying up while drafting him as a near top 20 starter.

Sánchez was a huge win for fantasy managers last year, but his ADP (low 180s) has now jumped too high given his modest K rate. Sánchez’s 20.3 K% ranked 45th among 57 qualified starters last season, and his extreme groundball rate will continue to hurt his WHIP. Sánchez is a fine pitcher, but he shouldn’t be going ahead of Robbie Ray and Jared Jones in NFBC leagues, and Nick Pivetta shouldn’t be available later than him in Yahoo leagues

Reynolds is a safe floor play, but you’re passing on players with far more upside at his ADP inside the top 100. Reynolds’ 24 homers, 73 runs scored and 10 stolen bases came via a career-high 692 plate appearances (top 15 in the league) last season. Being able to stay healthy is obviously a plus, but just realize there’s been a compounding component to Reynold’s fantasy value. The Pirates should remain one of the lowest scoring teams in 2025, so give me Christian Yelich straight up over Reynolds, who goes 30 picks earlier in Yahoo drafts

Suárez’s K-BB% dropped to 13.0% in August last season and then down to 5.9% in September, when he allowed eight earned runs over 12.0 innings. Suárez enters 2025 as San Diego’s closer, but Jeremiah Estrada was an elite reliever last year, and the Padres added Jason Adam during the offseason. Adam’s 2.12 ERA over the last three seasons ranks sixth-best among 185 relievers, and he has some closing experience. Alarmingly, Suárez’s CSW (23.9%) ranked 163rd out of 169 qualified relievers last season, while Adam’s 32.3% ranked 12th. Suárez’s K% (22.9) ranked outside the top 100 RPs last year, and he has legit arms behind him on San Diego’s depth chart, so don’t expect another 30+ saves.

Adames set career highs in homers (32), runs scored (93), RBI (112) and stolen bases (21) during his contract year last season. Hitting mostly cleanup helped Adames’ run production, but his RBI total came thanks to historic opportunity. Adames saw the most plate appearances (224) with runners in scoring position last season since 2012. He tied Ken Griffey Jr. with the most three-run homers in a season in MLB history (and later added a grand slam). Moreover, Adames posted a 1.073 OPS with runners in scoring position but just a .694 OPS with the bases empty.

Adames also will be hitting in a different lineup and in a much more favorable pitcher’s park after signing in San Francisco during the offseason. Milwaukee has increased HR for RHB by 11% over the last three seasons, whereas San Francisco has decreased them by 21%. Graphics may show all of Adames’ 150 career home runs theoretically leaving Oracle Park, but the main issue in San Francisco is air density, not park dimensions. Those fly balls simply won’t travel as far in the Bay Area. The Giants haven’t had a 30-homer hitter since 2004 for a reason; every other team has at least one since 2019.

Adames also never had more than eight steals in a season before his contract year, and he now joins a San Francisco organization that was the least likely to attempt a stolen base last season (50 SBA+). 

Arozarena would normally qualify as a bounce-back target coming off a down season, but he landed in an even more extreme pitcher’s park after leaving Tampa Bay last year. T-Mobile Park in Seattle played more extreme toward pitchers than Coors Field did hitters last season. For numerous reasons, T-Mobile Park limits walks and has increased strikeouts an MLB-high 15% over the last three seasons. No park has damaged batting average more over that span. Arozarena’s .219 batting average last year came with the same .219 expected BA, which was in the bottom 10% of the league.

Arozarena is now on the wrong side of 30 and has seen declining Sprint Speed each of the last four seasons. The Mariners (101 SBA+) are a less aggressive running team than the Rays (137 SBA+), and Arozarena recorded just four steals (with only five homers) over 54 games after joining Seattle last year. He shouldn’t be going more than a round before Pete Crow-Armstrong in Yahoo leagues

Helsley was great in 2024 while posting a 2.04 ERA, but he ran hot closing out games. Helsley’s 49 saves led MLB and set a franchise record; he somehow did so with the Cardinals winning just 83 games, as Helsley posted a save during an unsustainable 59% of St. Louis’ wins. The rebuilding Cardinals are projected to win even fewer games (79) in 2025, and Helsley had never recorded 20 saves or reached 65 innings in the majors before last year. He has a long injury history and averaged 99.6 mph with his fastball last season (fifth-highest among relievers).

Moreover, Helsley’s K% saw a significant drop from his previous two seasons, and his 3.08 SIERA ranked a more modest 35th among relief pitchers. Helsley is also an upcoming free agent who’s a candidate to be traded midseason. Don’t let last season’s gaudy save total influence you into drafting Helsley as a top five fantasy closer in 2025.

Fairbank’s K% plummeted from 37.0% in 2023 down to a career-low 23.8% last season. His SIERA has jumped from 1.09 in 2022 to 2.82 in 2023 to 3.75 last season, when his velocity saw a noticeable dip. Fairbank’s has constantly dealt with different injuries, as last season’s 45.1 innings matched a career high. Fairbanks has barely appeared in games so far this spring, and he remains a trade candidate midseason. The Rays will be moving from a pitcher’s paradise to a park with Yankee Stadium’s exact dimensions but warmer. Moreover, Tampa Bay has multiple alternatives in its bullpen, including Edwin Uceta and Mason Montgomery. Fairbanks is mistakenly being drafted ahead of Kenley Jansen, David Bednar and Jordan Romano in Yahoo leagues

Semien remains a fine compiler, but it took 718 plate appearances for him to record 23 homers and eight steals last season. Semien deserves credit for surpassing 700 PAs six straight seasons (not counting the shortened 2020), but his Bat Speed fell to the 10th percentile as a 33-year-old, and his 99 wRC+ ranked outside the top 100 qualified hitters. Semien will likely continue to run less now that he’s 34 years old, and manager Bruce Bochy plans on resting him more in 2025, yet he remains a top 70 pick in Yahoo leagues

Springer could be a target to bounce back at a lower ADP coming off a down year, but there are more concerns than just last season’s performance. Springer hit mostly leadoff last season, but he’s likely to bat toward the bottom half of Toronto’s lineup in 2025. It’s possible that leads to Springer hitting cleanup, but he just posted a .660 OPS (91 wRC+) with sinking peripherals (8.7 BB%, 21.6 K%) in the second half last year. Moreover, he’s been a disaster on defense over the last two seasons, so there’s even potential that fast-rising prospect Alan Roden eventually ends up taking Springer’s job

Abrams is just 24 years old and could improve, but he hit .203 with an ugly 64 wRC+ after the All-Star break last season, contributing to a brief trip to Triple-A. Counting stats will remain an issue on the Nationals, and Abrams sports a cold Statcast page (and a career 94 wRC+). The steals are nice, but more are available later in drafts than ever. Abrams is being drafted next to Oneil Cruz, Jacob deGrom and Wyatt Langford and ahead of James Wood in Yahoo leagues, all of whom are preferred picks.

USDA Announces Approval of D-SNAP for West Virginia Disaster Areas

WASHINGTON, Mar. 13, 2025 – The U.S. Department of Agriculture (USDA) announced that people recovering from recent severe storms, straight-line winds, flooding, landslides and mudslides may be eligible for food assistance through USDA’s Disaster Supplemental Nutrition Assistance Program (D-SNAP). Nearly 3,000 households in four counties in West Virginia are estimated to be eligible for this relief to help with grocery expenses.

Siemens SIMATIC IPC Family, ITP1000, and Field PGs

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 8.4
  • ATTENTION: Low attack complexity
  • Vendor: Siemens
  • Equipment: SIMATIC IPC Family, SIMATIC ITP1000, SIMATIC Field PGs
  • Vulnerabilities: Protection Mechanism Failure

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an authenticated attacker to alter the secure boot configuration or to disable the BIOS password.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

  • Siemens SIMATIC Field PG M5: All versions
  • Siemens SIMATIC IPC377G: All versions
  • Siemens SIMATIC IPC427E: All versions
  • Siemens SIMATIC IPC477E: All versions
  • Siemens SIMATIC IPC477E PRO: All versions
  • Siemens SIMATIC IPC527G: All versions
  • Siemens SIMATIC IPC627E: Versions prior to 25.02.15
  • Siemens SIMATIC IPC647E: Versions prior to V25.02.15
  • Siemens SIMATIC IPC677E: Versions prior to V25.02.15
  • Siemens SIMATIC IPC847E: Versions prior to V25.02.15
  • Siemens SIMATIC IPC3000 SMART V3: All versions
  • Siemens SIMATIC Field PG M6: Versions prior to V26.01.12 (CVE-2024-56182)
  • Siemens SIMATIC IPC BX-21A: Versions prior to V31.01.07
  • Siemens SIMATIC IPC BX-32A: Versions prior to V29.01.07
  • Siemens SIMATIC IPC BX-39A: Versions prior to V29.01.07
  • Siemens SIMATIC IPC BX-59A: Versions prior to V32.01.04
  • Siemens SIMATIC IPC PX-32A: Versions prior to V29.01.07
  • Siemens SIMATIC IPC PX-39A: Versions prior to V29.01.07
  • Siemens SIMATIC IPC PX-39A PRO: Versions prior to V29.01.07
  • Siemens SIMATIC IPC RC-543B: All versions
  • Siemens SIMATIC IPC RW-543A: All versions
  • Siemens SIMATIC ITP1000: All versions
  • Siemens SIMATIC IPC127E: All versions
  • Siemens SIMATIC IPC277G PRO: All versions
  • Siemens SIMATIC IPC227E: All versions
  • Siemens SIMATIC IPC227G: All versions
  • Siemens SIMATIC IPC277E: All versions
  • Siemens SIMATIC IPC277G: All versions
  • Siemens SIMATIC IPC327G: All versions
  • Siemens SIMATIC IPC347G: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 PROTECTION MECHANISM FAILURE CWE-693

The affected devices have insufficient protection mechanism for the EFI (Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to alter the secure boot configuration without proper authorization by directly communicating with the flash controller.

CVE-2024-56181 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-56181. A base score of 8.4 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H).

3.2.2 PROTECTION MECHANISM FAILURE CWE-693

The affected devices have insufficient protection mechanism for the EFI (Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to disable the BIOS password without proper authorization by directly communicating with the flash controller.

CVE-2024-56182 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-56182. A base score of 8.4 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

  • Restrict access to root/administrator permission for the operating system
  • SIMATIC IPC627E, SIMATIC IPC647E, SIMATIC IPC677E, SIMATIC IPC847E: Update to V25.02.15 or later version
  • SIMATIC IPC BX-39A, SIMATIC IPC PX-39A, SIMATIC IPC PX-39A PRO, SIMATIC IPC BX-32A, SIMATIC IPC PX-32A: Update to V29.01.07 or later version
  • SIMATIC IPC BX-21A: Update to V31.01.07 or later version
  • SIMATIC IPC BX-59A: Update to V32.01.04 or later version
  • SIMATIC Field PG M6: Update to V26.01.12 or later version
  • SIMATIC Field PG M5, SIMATIC IPC RC-543B, SIMATIC IPC RW-543A, SIMATIC IPC127E, SIMATIC IPC227G, SIMATIC IPC277G, SIMATIC IPC277G PRO, SIMATIC IPC3000 SMART V3, SIMATIC IPC327G, SIMATIC IPC347G, SIMATIC IPC377G, SIMATIC IPC427E, SIMATIC IPC477E, SIMATIC IPC477E PRO, SIMATIC IPC527G, SIMATIC ITP1000, SIMATIC IPC227E, SIMATIC IPC277E: Currently no fix is available

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-216014 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

5. UPDATE HISTORY

  • March 13, 2025: Initial Publication

Philips Intellispace Cardiovascular (ISCV)

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 8.5
  • ATTENTION: Low attack complexity
  • Vendor: Philips
  • Equipment: Intellispace Cardiovascular (ISCV)
  • Vulnerabilities: Improper Authentication, Use of Weak Credentials

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to replay the session of the logged in ISCV user and gain access to patient records.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Philips reports the following versions of Intellispace Cardiovascular (ISCV), an image and information management product, are affected:

  • Intellispace Cardiovascular (ISCV): Version 4.1 and prior (CVE-2025-2229)
  • Intellispace Cardiovascular (ISCV): Version 5.1 and prior (CVE-2025-2230)

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER AUTHENTICATION CWE-287

A flaw exists in the Windows login flow where an AuthContext token can be exploited for replay attacks and authentication bypass.

CVE-2025-2230 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.7 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2025-2230. A base score of 8.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).

3.2.2 USE OF WEAK CREDENTIALS CWE-1391

A token is created using the username, current date/time, and a fixed AES-128 encryption key, which is the same across all installations.

CVE-2025-2229 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.7 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2025-2229. A base score of 8.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Healthcare and Public Health
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Netherlands

3.4 RESEARCHER

Joe Dillon reported these vulnerabilities to Philips.

4. MITIGATIONS

Philips recommends the following mitigations:

  • CVE-2025-2230: Resolved in ISCV 4.2 build 20589, which was released in May 2019.
  • CVE-2025-2229: Resolved in ISCV 5.2, which was released in September 2020.
  • Philips recommends users upgrade ISCV installed base to the latest ISCV version (at the time of this publication is 830089 – IntelliSpace Cardiovacular 8.0.0.0)
  • Please contact a local Philips sales (service) representative to learn how to engage this upgrade process.
  • For managed services users, new releases will be made available upon resource availability. Releases are subject to country-specific regulations.

Refer to the Philips advisory for more details.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

5. UPDATE HISTORY

  • March 13, 2025: Initial Publication

Siemens SINEMA Remote Connect Server

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 7.1
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Siemens
  • Equipment: SINEMA Remote Connect Server
  • Vulnerabilities: Improper Output Neutralization for Logs, Missing Release of Resource after Effective Lifetime

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to send garbage to OpenVPN log, cause high CPU load, or extend the validity of a closing session.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports the following products are affected:

  • SINEMA Remote Connect Server: Versions prior to V3.2 SP3

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER OUTPUT NEUTRALIZATION FOR LOGS CWE-117

A malicious openvpn peer can send garbage to OpenVPN log or cause high CPU load.

CVE-2024-5594 has been assigned to this vulnerability. A CVSS v3 base score of 5.4 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

A CVSS v4 score has also been calculated for CVE-2024-5594. A base score of 5.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N).

3.2.2 MISSING RELEASE OF RESOURCE AFTER EFFECTIVE LIFETIME CWE-772

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session.

CVE-2024-28882 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2024-28882. A base score of 7.1 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy, Food and Agriculture, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has released a new version for SINEMA Remote Connect Server and recommends updating to V3.2 SP3 or later version.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-073066 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

  • March 13, 2025: Initial Publication

Siemens Teamcenter Visualization and Tecnomatrix Plant Simulation

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 7.3
  • ATTENTION: Low attack complexity
  • Vendor: Siemens
  • Equipment: Teamcenter Visualization and Tecnomatrix Plant Simulation
  • Vulnerabilities: Out-of-bounds Write, Improper Restriction of Operations within the Bounds of a Memory Buffer, Out-of-bounds Read, Use After Free

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could cause the application to crash or potentially lead to arbitrary code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports the following products are affected:

  • Teamcenter Visualization V14.3: Versions prior to V14.3.0.13
  • Teamcenter Visualization V2312: Versions prior to V2312.0009
  • Teamcenter Visualization V2406: Versions prior to V2406.0007
  • Teamcenter Visualization V2412: Versions prior to V2412.0002
  • Tecnomatix Plant Simulation V2302: Versions prior to V2302.0021
  • Tecnomatix Plant Simulation V2404: Versions prior to V2404.0010

3.2 VULNERABILITY OVERVIEW

3.2.1 OUT-OF-BOUNDS WRITE CWE-787

The affected applications contain an out-of-bounds write vulnerability when parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process.

CVE-2025-23396 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-23396. A base score of 7.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.2 IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119

The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

CVE-2025-23397 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-23397. A base score of 7.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.3 IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119

The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

CVE-2025-23398 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-23398. A base score of 7.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.4 OUT-OF-BOUNDS READ CWE-125

The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

CVE-2025-23399 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-23399. A base score of 7.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.5 IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119

The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

CVE-2025-23400 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-23400. A base score of 7.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.6 OUT-OF-BOUNDS READ CWE-125

The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

CVE-2025-23401 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-23401. A base score of 7.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.7 USE AFTER FREE CWE-416

The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted WRL files. An attacker could leverage this vulnerability to execute code in the context of the current process.

CVE-2025-23402 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-23402. A base score of 7.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.2.8 OUT-OF-BOUNDS READ CWE-125

The affected applications contain an out-of-bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

CVE-2025-27438 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2025-27438. A base score of 7.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Jin Huang from ADLab of Venustech and Michael Heinzl reported these vulnerabilities to Siemens.

4. MITIGATIONS

Siemens has released new versions for the affected products and recommends to update to the latest versions:

To reduce risk, Siemens recommends that users not open untrusted WRL files in affected applications.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-050438 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

5. UPDATE HISTORY

  • March 13, 2025: Initial Publication

CISA Releases Thirteen Industrial Control Systems Advisories

CISA released thirteen Industrial Control Systems (ICS) advisories on March 13, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.

Siemens OPC UA

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 9.3
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Siemens
  • Equipment: OPC UA
  • Vulnerabilities: Observable Timing Discrepancy, Authentication Bypass by Primary Weakness

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to bypass application authentication and gain access to the data managed by the server.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

  • Industrial Edge for Machine Tools (formerly known as “SINUMERIK Edge”): All versions (CVE-2024-42513)
  • SIMIT V11: All versions (CVE-2024-42512)
  • SIMATIC BRAUMAT: All versions from V8.0 SP1 up to but not including V8.1 (CVE-2024-42513)
  • SIMATIC Energy Manager PRO: All versions from V7.5 up to but not including V7.5 Update 2
  • SIMATIC Energy Manager PRO: All versions after V7.2 Update 6
  • SIMATIC IPC DiagMonitor: All versions (CVE-2024-42513)
  • SIMATIC SISTAR: All versions from V8.0 SP1 up to but not including V8.1 (CVE-2024-42513)
  • SIMATIC WinCC Unified V18: All versions (CVE-2024-42513)
  • SIMATIC WinCC Unified V19: All versions before V19 Update 4 (CVE-2024-42513)
  • SIMATIC WinCC V8.0: All versions before V8.0 Update 3 (CVE-2024-42513)

3.2 VULNERABILITY OVERVIEW

3.2.1 OBSERVABLE TIMING DISCREPANCY CWE-208

Vulnerability in the OPC UA .NET standard stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.

CVE-2024-42512 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2024-42512. A base score of 9.1 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).

3.2.2 AUTHENTICATION BYPASS BY PRIMARY WEAKNESS CWE-305

Vulnerability in the OPC UA .NET standard stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.

CVE-2024-42513 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2024-42513. A base score of 9.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater Systems
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported these vulnerabilities to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

  • SIMATIC Energy Manager PRO: Update to V7.5 Update 2 or later version.
  • (CVE-2024-42512) SIMATIC Energy Manager PRO, SIMIT V11: Currently no fix is available.
  • (CVE-2024-42513) SIMATIC WinCC Unified V18, SIMATIC WinCC Unified V19: Please note that the affected functionality (HTTPS endpoint in OPC UA server) is deactivated by default in Unified RT. Systems running with default configuration are therefore not affected by this vulnerability.
  • (CVE-2024-42513) SIMATIC IPC DiagMonitor: Please note that the affected functionality (HTTPS endpoint in OPC UA Server) is deactivated by default. Systems running with default configuration are therefore not affected by this vulnerability.
  • (CVE-2024-42513) Industrial Edge for Machine Tools (formerly known as “SINUMERIK Edge”), SIMATIC IPC DiagMonitor: Currently no fix is planned.
  • (CVE-2024-42513) SIMATIC Energy Manager PRO, SIMATIC WinCC Unified V18: Currently no fix is available.
  • (CVE-2024-42513) SIMATIC WinCC Unified V19: Update to V19 Update 4 or later version.
  • (CVE-2024-42513) SIMATIC WinCC V8.0: Update to V8.0 Update 3 or later version.
  • (CVE-2024-42513) SIMATIC BRAUMAT, SIMATIC SISTAR: Update to V8.1 or later version.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-858251 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

  • March 13, 2025: Initial Publication

Sungrow iSolarCloud Android App WiNet Firmware

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 9.5
  • ATTENTION: Exploitable remotely
  • Vendor: Sungrow
  • Equipment: iSolarCloud Android App, WiNet Firmware
  • Vulnerabilities: Improper Certificate Validation, Use of a Broken or Risky Cryptographic Algorithm, Authorization Bypass Through User-Controlled Key, User of Hard-Coded Credentials, Stack-Based Buffer Overflow, Heap-Based Buffer Overflow

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could result in attackers being able to access and could modify sensitive information.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Sungrow software products are affected:

  • iSolarCloud Android App: Version 2.1.6 and prior
  • WiNet Firmware: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER CERTIFICATE VALIDATION CWE-295

The Android app for iSolarCloud explicitly ignores certificate errors and is vulnerable to adversary-in-the-middle attacks. This may allow an attacker to impersonate the iSolarCloud server and communicate with the Android app.

CVE-2024-50691 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50691. A base score of 8.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N).

3.2.2 USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327

The iSolarCloud Android mobile application uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud.

CVE-2024-50684 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50684. A base score of 8.3 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N).

3.2.3 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639

The iSolarCloud API is vulnerable to multiple insecure direct object references (IDOR) via the powerStationService API model. This vulnerability may allow an attacker to gain unauthorized access to user data and potentially modify key identifying data values.

CVE-2024-50685 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50685. A base score of 6.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N).

3.2.4 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639

The Solar iCloud API is vulnerable to multiple insecure direct object references (IDOR) via the userService API model. This vulnerability may allow an attacker to gain unauthorized access to user data and potentially modify key identifying data values.

CVE-2024-50693 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50693. A base score of 9.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N).

3.2.5 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639

The Solar iCloud API is vulnerable to multiple insecure direct object references (IDOR) via the orgService API model. This vulnerability may allow an attacker to gain unauthorized access to user data and potentially modify key identifying data values.

CVE-2024-50689 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50689. A base score of 9.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N).

3.2.6 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639

The Solar iCloud API is vulnerable to multiple insecure direct object references (IDOR) via the commonService API model. This vulnerability may allow an attacker to gain unauthorized access to user data and potentially modify key identifying data values.

CVE-2024-50686 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50686. A base score of 6.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N).

3.2.7 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY CWE-639

The Solar iCloud API is vulnerable to multiple insecure direct object references (IDOR) via the devService API model. This vulnerability may allow an attacker to gain unauthorized access to user data and potentially modify key identifying data values.

CVE-2024-50687 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50687. A base score of 6.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N).

3.2.8 USE OF HARD-CODED CREDENTIALS CWE-798

The iSolarCloud Android application and the cloud use hard-coded MQTT credentials for exchanging the device telemetry. This vulnerability may allow an attacker to gain unauthorized access to user accounts, sensitive information, and execute arbitrary code.

CVE-2024-50688 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50688. A base score of 6.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N).

3.2.9 USE OF HARD-CODED CREDENTIALS CWE-798

The WiNet’s module firmware contains hardcoded MQTT credentials that could allow an attacker to impersonate a device-facing MQTT broker. This vulnerability may allow an attacker to gain unauthorized access to user accounts, sensitive information, and execute arbitrary code.

CVE-2024-50692 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-50692. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

3.2.10 USE OF HARD-CODED PASSWORD CWE-259

The WiNet WebUI contains a hard-coded password that can be used to decrypt all firmware updates. This vulnerability can allow an attacker to gain unauthorized access to accounts.

CVE-2024-50690 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

A CVSS v4 score has also been calculated for CVE-2024-50690. A base score of 6.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N).

3.2.11 STACK-BASED BUFFER OVERFLOW CWE-121

When copying the time stamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is used to store the message. This may lead to a stack-based buffer overflow in which an attacker could potentially execute arbitrary code, remotely.

CVE-2024-50694 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-50694. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

3.2.12 STACK-BASED BUFFER OVERFLOW CWE-121

When decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bounds checks. This may result in a stack-based buffer overflow in which an attacker could potentially execute arbitrary code, remotely.

CVE-2024-50697 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-50697. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

3.2.13 STACK-BASED BUFFER OVERFLOW CWE-121

There is a potential stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds checks. The affected products are vulnerable to a stack-based buffer overflow which may allow an attacker to remotely execute arbitrary code.

CVE-2024-50695 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-50695. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

3.2.14 HEAP-BASED BUFFER OVERFLOW CWE-122

The affected products are vulnerable to a heap-based buffer overflow, due to bounds checks of the MQTT message content. This vulnerability may allow an attacker to remotely execute arbitrary code.

CVE-2024-50698 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-50698. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

3.2.15 DOWNLOAD OF CODE WITHOUT INTEGRITY CHECK CWE-494

The affected products lack proper integrity checks during the update process. This vulnerability allows an attacker to send a specific MQTT message to install potentially harmful firmware files hosted on an attacker-controlled server. This could result in unauthorized control of affected devices.

CVE-2024-50696 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-50696. A base score of 9.5 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: China

3.4 RESEARCHER

Daniel dos Santos, Stanislav Dashevskyi, and Francesco La Spina of Forescout Technologies reported these vulnerabilities to CISA.

4. MITIGATIONS

Sungrow has released updated versions of affected firmware. Users are encouraged to apply version WINET-SV200.001.00.P028 or higher. Users should also update their iSolarCloud Android App to the latest version via device app store. The iSolarCloud has been repaired and requires no further user action.

For more information refer to Sungrow’s security notice.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

5. UPDATE HISTORY

  • March 13, 2025: Initial Publication

Thunder’s championship mettle on display in yet another win over Celtics

BOSTON — This was one the defending champions wanted. The Oklahoma City Thunder clamped the visiting Boston Celtics late in a January victory, and in its title defense Boston had not yet lost a season series to another contender.

Except OKC did it again Wednesday, leveraging an 8-0 run midway through the fourth quarter to create separation in what had been to that point a great game between two great teams. The Thunder won the prizefight 118-112 showing a level of maturity that belied their youth, the very mettle you need to win a championship.

But Oklahoma City coach Mark Daigneault did not want his team to get ahead of itself.

“It’s March,” he said, “not June.”

[Yahoo Fantasy Bracket Mayhem is back: Enter for a shot to win up to $50K]

Thunder superstar Shai Gilgeous-Alexander, the NBA’s MVP favorite, who collected his customary 34 points, seven assists and five rebounds, was a little more willing to entertain this as a statement win.

“Because they’ve done what we’re trying to do, the games against them are always going to be a little more heightened and exciting,” he said. “They’ve achieved what we’re trying to accomplish, and there’s no better test in the NBA. We play for late June, and they’re the team that won, so playing against them is … something that we need to test ourselves against, and I guess we’ve passed the two tests so far.”

Oklahoma City was without its second All-Star, Jalen Williams, as he nurses a hip strain, but Chet Holmgren, who missed three months of his own to injury, stepped into that secondary role. His 23 points, 15 rebounds and ceaseless rim protection wreaked havoc in the absence of Boston’s Kristaps Porzingis.

Oklahoma City guard Shai Gilgeous-Alexander led all scorers in Wednesday’s Thunder-Celtics matchup with 34 points en route to an OKC win in enemy territory. (AP Photo/Charles Krupa)
ASSOCIATED PRESS

Boston was also without a co-star, Jaylen Brown, though he played. Brown scored 10 points on 15 shots and fouled out in 38 minutes. He refused to blame the right knee issue that has cost him four games in recent weeks, instead crediting those who deserved it: Cason Wallace and OKC’s relentless defense.

“Tougher team sets the rules,” said Brown. “I didn’t meet their level of physicality.”

The Celtics as a whole did not meet the Thunder’s level of physicality. They did not make a 2-point shot in the first quarter, when 20 of their 22 attempts came from 3. Their 35 first-half threes attempted were a record, and they finished 20 of 63 (32%) from distance. These were the shots they could find. Even if their creators could get around Wallace and Lu Dort on the perimeter, Holmgren and Isaiah Hartenstein waited in the middle.

This is a problem for the Celtics if these two teams meet in June. Not many opponents can claim to be a matchup problem for Boston, but Oklahoma City can after owning the fourth quarter in both meetings.

The Celtics skated to the championship last season largely without Porzingis, who has missed the past six games of this season to an unidentified viral infection. They will need him to defend their championship — against the Cleveland Cavaliers, before they get a chance to meet OKC again — and Boston knows it.

“We’ll feel a lot better when we have everybody,” said Jayson Tatum, whose 33 points, eight rebounds and eight assists kept Boston in the game. “I’m looking forward to having our full team at full strength for this last stretch. We’ll fine-tune some things up and get ready for the fun part of all this.”

That would be the playoffs, when the Celtics will remain the champions until someone knocks them off. They have won it before, so therefore believe they can do it again. The Thunder cannot say the same.

But they said all they needed to on Wednesday. When asked what separated the Celtics from the pack last season, Gilgeous-Alexander may as well have been talking about his own team’s mentality in Boston.

“They don’t flinch or budge,” he said. “When you play against them, they are confident, and they know what they’re trying to accomplish on both ends of the floor, and they do it at a high level. I think that’s what makes them so good. Whether the ball goes in or out for them doesn’t deter the way they play.”

In fact, Tatum said the same of them.

“They play the right way,” he said. “They know what they want to do on both ends. This was high level.”

The only knock against the Western Conference-leading Thunder now is the fact they have not reached a conference finals as a team. They lost in the second round last season to the Dallas Mavericks. 

“We got better than we were last year,” said Gilgeous-Alexander, whose Thunder (54-12) clinched a playoff berth on Wednesday.

“I think we got a couple new guys who made our team a lot better,” added Holmgren, “but I also think that everyone that returned worked their tail off this summer and came back even better.” 

Scary thought. If poise and maturity are the only criticisms left to hurl at the Thunder, it was as if Daigneault knew that and wanted us to know: This game on this night showed his team has both.

“It was a 48-minute effort,” said the 40-year-old Massachusetts native. “This was a hard game to win. The [Celtics] keep coming. They shoot threes, so they can cut into leads quickly. There was a lot of lead changes, and I just thought our team’s poise and discipline and competitiveness was on display tonight.”

And if it is again come June, Brown countered, “We’ll be ready.”

“We’ll see when we get there,” added Tatum.

The defending champions have work to do. The Thunder made that clear.