CISA ICSA-25-189-01 Emerson Industrial Control System Security Advisory

Vulnerability Overview Vulnerability ID: ICSA-25-189-01 Organization: Emerson Summary: Report these vulnerabilities to CISA Classification: csaf_security_advisory CSAF Version: 2.0 Distribution: No restrictions on disclosure Tags: WHITE URL: https://us-cert.cisa.gov/tlp/ Affected Scope Category: Other Text: Critical Manufacturing Title: Critical Infrastructure Sector Category: Other Text: Global Title: Countries Where Deployed Category: Other Text: United States Title: Company Headquarters Location Mitigation Steps Category: General Text: CISA recommends that users take defensive actions to minimize the risk of exploitation of these vulnerabilities. Title: Recommended Practices Category: General Text: Minimize the network exposure of all control system equipment and/or systems and ensure that they are not accessible from the Internet. Title: Recommended Practices Category: General Text: Place control system networks and remote devices behind firewalls and isolate them from the business network. Title: Recommended Practices Category: General Text: Use more secure access methods such as virtual private networks (VPNs) when remote access is required and enable multi-factor authentication. Title: Recommended Practices Category: General Text: CISA reminds organizations to perform proper impact analysis and risk assessment before deploying defensive measures. Title: Recommended Practices Category: General Text: CISA also provides a section on recommended practices for control systems security, which can be found on the ICS page of the CISA website. Title: Recommended Practices Category: General Text: CISA encourages organizations to implement recommended cybersecurity policies to proactively defend against ICS threats. Title: Recommended Practices Category: General Text: Additional mitigation guidance and recommended practices are publicly available on the ICS webpage. Title: Recommended Practices Category: General Text: Organizations observing suspicious malicious activity should follow internal procedures and report to CISA. Title: Recommended Practices Category: General Text: There are currently no public reports of specific exploitation targeting these vulnerabilities. Title: Recommended Practices References Category: Self Summary: ICSA-25-189-01 350N URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icss-25-189-01.json Category: Self Summary: ICSA Advisory ICSA-25-189-01 - Web Version URL: https://www.cisa.gov/news-events/ics-advisories/icss-25-189-01 Category: External Summary: Recommended Practices URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-361-01 Category: External Summary: Recommended Practices URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices Category: External Summary: Recommended Practices URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf Category: External Summary: Recommended Practices URL: https://www.cisa.gov/topics/industrial-control-systems Category: External Summary: Recommended Practices URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCSC_ICS-CERT_Defense_in_Depth_2016_350N.pdf Category: External Summary: Recommended Practices URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B Category: External Summary: Recommended Practices URL: https://www.cisa.gov/sites/default/files/publications/emalscam0905.pdf Category: External Summary: Recommended Practices URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014 Publisher Category: Coordinator Contact Details: central@cisa.dhs.gov Name: CISA Namespace: https://www.cisa.gov Legal Disclaimer Category: Legal Disclaimer Text: All information products contained within https://us-cert.cisa.gov/ics are provided "as is" for informational purposes. Title: Legal Disclaimer Risk Assessment Category: Summary Text: Successful exploitation of these vulnerabilities may allow an attacker to access the system to read, modify, or delete data. Title: Risk Assessment Country Category: Other Text: United States Title: Company Headquarters Location Global Deployment Category: Other Text: Global Title: Countries Where Deployed Critical Manufacturing Category: Other Text: Critical Manufacturing Title: Critical Infrastructure Sector Recommended Practices Category: General Text: CISA recommends that users take defensive actions to minimize the risk of exploitation of these vulnerabilities. Title: Recommended Practices Category: General Text: Minimize the network exposure of all control system equipment and/or systems and ensure that they are not accessible from the Internet. Title: Recommended Practices Category: General Text: Place control system networks and remote devices behind firewalls and isolate them from the business network. Title: Recommended Practices Category: General Text: Use more secure access methods such as virtual private networks (VPNs) when remote access is required and enable m

Goal Reached Thanks to every supporter — we hit 100%!

CISA ICSA-25-189-01 Emerson Industrial Control System Security Advisory

More from this source