Skip to main content
OT Atlas
Search

Vulnerabilities

OT vulnerabilities: live and by class

Known exploited CVEs affecting industrial vendors, pulled live from CISA KEV and NVD — plus what each weakness class actually means once it sits on a controller.

Patching is one option among several

In OT, remediation choices are patch, mitigate, isolate, monitor or formally accept — each recorded with a rationale and an owner. A vendor-unvalidated patch applied outside a maintenance window is itself a reliability risk.

Vulnerability management workflow →Full CISA KEV catalogue and filter audit →CISA ICS advisories →

Prioritise on

  • Reachability from an untrusted zone
  • Process consequence if exploited
  • Known exploitation in the wild
  • Availability of a compensating control

Why should I care?

A CVSS 9.8 on an isolated device with no reachable path may matter less than a medium-severity flaw on the one host that bridges IT and OT. Score consequence, not just severity.

Live feed

Known exploited vulnerabilities relevant to OT

Pulled live from the CISA KEV catalog and enriched on demand from the NVD CVE API. Filtered to industrial, control-system and cyber-physical vendors and products.

Fetching CISA KEV…
—

Reference

Vulnerability classes in control systems

What each weakness means once it sits on a controller, and what to do when patching is not an option.

Remote Code Execution

CWE-94 / CWE-787 family

An attacker can run code of their choosing on the affected device or host.

Why OT cares

Code execution on an engineering host, HMI or controller places the process itself within reach.

Consequence

Full compromise of the affected system and any process function it performs.

How to find it

  • Vendor advisories and CISA ICS advisories
  • Version inventory comparison
  • Network reachability analysis for affected services

How to mitigate

  • Patch during a planned window after vendor validation
  • Restrict reachability to the vulnerable service
  • Enhanced monitoring on affected hosts

Authentication Bypass

CWE-287

Access is possible without presenting valid credentials.

Why OT cares

Many OT devices have only one authentication layer; bypassing it means full device control.

Consequence

Unauthorised configuration or control of the device.

How to find it

  • Advisory review
  • Testing in a lab, never on production devices
  • Check whether the affected interface is reachable

How to mitigate

  • Patch where possible
  • Remove reachability to the affected interface
  • Network-layer authentication in front of the device

Hardcoded Credentials

CWE-798

Credentials are embedded in firmware or software and cannot be changed by the operator.

Why OT cares

You cannot remediate by changing a password; the control must be architectural.

Consequence

Anyone who can reach the device and knows the credential has access.

How to find it

  • Vendor advisories
  • Firmware version inventory

How to mitigate

  • Restrict network reachability tightly
  • Vendor firmware update where offered
  • Compensating monitoring on the device's conduit

Default Credentials

CWE-1392

Devices ship with well-known credentials that are never changed.

Why OT cares

Documented incidents at water utilities show this alone is enough to reach controllers.

Consequence

Trivial unauthorised access.

How to find it

  • Credential audits during maintenance
  • Commissioning checklists
  • Advisory review

How to mitigate

  • Change at commissioning with a managed credential store
  • Verify during periodic audits

Command Injection

CWE-77 / CWE-78

Untrusted input is passed to a system command interpreter.

Why OT cares

Common in device web interfaces, which are often enabled by default on industrial equipment.

Consequence

Command execution with the privileges of the affected service.

How to find it

  • Advisories
  • Inventory of devices with web/management interfaces enabled

How to mitigate

  • Disable unused management interfaces
  • Patch
  • Restrict management access to a dedicated network

Buffer Overflow / Memory Corruption

CWE-120 / CWE-787

Malformed input corrupts memory, causing a crash or potentially code execution.

Why OT cares

Even a crash matters: a controller reset is a process event, not just a security event.

Consequence

Denial of service or code execution.

How to find it

  • Advisories
  • Protocol stack version data
  • Crash and restart patterns in device logs

How to mitigate

  • Patch
  • Protocol-aware filtering at conduits
  • Limit which peers can reach the affected service

Path Traversal

CWE-22

Input is used to access files outside the intended directory.

Why OT cares

Configuration and project files often contain credentials and full process descriptions.

Consequence

Disclosure or modification of sensitive files.

How to find it

  • Advisories
  • Review of file-serving interfaces on devices and applications

How to mitigate

  • Patch
  • Restrict interface reachability
  • Remove sensitive data from device-served paths

Improper Access Control

CWE-284

Functions are reachable by users or peers that should not be authorised for them.

Why OT cares

Read-only intent frequently turns out to permit writes in practice.

Consequence

Unauthorised configuration or control actions.

How to find it

  • Advisories
  • Reviewing role configuration on OT applications

How to mitigate

  • Patch and configure roles explicitly
  • Enforce least privilege at the conduit

Improper Input Validation

CWE-20

The device or application accepts input it should reject.

Why OT cares

Industrial protocol stacks are frequently fragile with malformed input.

Consequence

Crashes, unpredictable behaviour, sometimes execution.

How to find it

  • Advisories
  • Lab testing only
  • Device crash history

How to mitigate

  • Patch
  • Protocol-aware inspection
  • Restrict who can send the affected traffic

Insecure Firmware

Firmware contains known-vulnerable components or weak protections.

Why OT cares

Firmware updates require outages, so exposure windows are long.

Consequence

Persistent compromise below the application layer.

How to find it

  • Firmware version register
  • Vendor advisories
  • SBOM data where available

How to mitigate

  • Planned firmware lifecycle programme
  • Compensating segmentation and monitoring

Unsigned Firmware Updates

CWE-345

The device accepts firmware without verifying its authenticity.

Why OT cares

An attacker with device access can install modified firmware that survives recovery.

Consequence

Durable, hard-to-detect compromise.

How to find it

  • Vendor documentation on update verification
  • Advisories

How to mitigate

  • Prefer devices supporting signed firmware in procurement
  • Restrict update paths and monitor firmware versions

Weak Cryptography

CWE-327

Outdated or improperly implemented cryptographic protections.

Why OT cares

Long device lifecycles leave obsolete algorithms in production for years.

Consequence

Interception or forgery of protected communications.

How to find it

  • Advisories
  • TLS/cipher configuration reviews

How to mitigate

  • Configure stronger options where supported
  • Tunnel at the network layer
  • Plan replacement

Cleartext Credentials

CWE-319

Credentials traverse the network or are stored without protection.

Why OT cares

Legacy industrial protocols and device web interfaces frequently do this by design.

Consequence

Credential capture enabling legitimate-looking access.

How to find it

  • Passive protocol review in a lab
  • Advisories
  • Configuration review

How to mitigate

  • Encrypted management paths
  • Segment management traffic
  • Unique credentials per device

Privilege Escalation

CWE-269

A lower-privileged user or process gains higher privileges.

Why OT cares

Turns limited access on an OT host into administrative control of a control-capable system.

Consequence

Full host compromise.

How to find it

  • Advisories
  • Host patch level review

How to mitigate

  • Patch
  • Least-privilege configuration
  • Application allow-listing

Denial of Service

CWE-400

The device or service can be made unavailable.

Why OT cares

In OT, availability is a primary requirement — DoS can equal a process trip.

Consequence

Loss of control or view; potential production stop.

How to find it

  • Advisories
  • Device restart and fault history

How to mitigate

  • Patch
  • Rate limiting and protocol inspection at conduits
  • Restrict who can reach the service

Insecure Update Mechanisms

The update process itself lacks integrity or authenticity controls.

Why OT cares

Update channels reach many devices at once and are trusted implicitly.

Consequence

Mass compromise through a trusted path.

How to find it

  • Vendor documentation
  • Advisories
  • Update infrastructure review

How to mitigate

  • Control and monitor update servers
  • Verify packages independently where possible

Exposed Management Services

Web, SSH, Telnet or vendor management services reachable beyond their intended scope.

Why OT cares

Industrial devices often enable these by default and they are rarely inventoried.

Consequence

An additional, often weakly protected, attack path per device.

How to find it

  • Passive service discovery
  • Configuration review
  • External attack-surface data

How to mitigate

  • Disable unused services
  • Dedicated management network
  • Credential management

Unauthenticated Industrial Commands

The protocol accepts control commands without authenticating the sender.

Why OT cares

This is the normal state for many industrial protocols — a design property, not a bug to patch.

Consequence

Anyone with network reach can issue process-affecting commands.

How to find it

  • Protocol inventory
  • Reachability analysis per controller

How to mitigate

  • Segmentation and strict peer lists
  • Authenticated protocol variants where available
  • Detection of unauthorised command sources