All news with #xml external entity tag

Thu, October 16, 2025

Rockwell FactoryTalk ViewPoint XML External Entity Flaw

#Security Advisory #Patch #Rockwell Automation #PanelView Plus #XML External Entity

🔒 Rockwell Automation reported a FactoryTalk ViewPoint XML External Entity (XXE) vulnerability (CVE-2025-9066) that can be exploited remotely with low attack complexity to induce a temporary denial-of-service via crafted SOAP requests. Affected devices include PanelView Plus 7 terminals (version 14 and prior). Rockwell released firmware fixes and patches, and CISA recommends minimizing network exposure, isolating control networks, and applying vendor updates promptly. The vulnerability is scored CVSS v4 8.7 (CVSS v3.1 7.5).

read more →

Tue, September 2, 2025

Delta EIP Builder XXE Vulnerability (CVE-2025-57704)

#Delta Electronics #Disclosure #Patch #Security Advisory #XML External Entity

🔒 Delta Electronics' EIP Builder (versions 1.11 and earlier) contains an XML External Entity (XXE, CWE-611) vulnerability tracked as CVE-2025-57704 with a CVSS v4 base score of 6.7 and low attack complexity. The flaw can allow processing of malicious external entities and potential disclosure of sensitive information; exploitation requires local access and user interaction. Delta has released v1.12 to address the issue, and CISA recommends applying the update and following ICS defensive practices.