CISA flags 13 flaws in Ebyte NA111-M firmware in Aug. 27 advisory
CISA said the affected Ebyte firmware is deployed worldwide and that no known public exploitation had been reported when the advisory was published.
Regulatory
CISA flags critical flaws in Applied Systems Engineering ASE2000 test set
CISA issued an advisory on ASE2000 V2 Communications Test Set versions 2.25 through 2.37, citing two vulnerabilities and urging an upgrade to version 2.38 or later.
CISA flags password-hash weakness in Rockwell OTTO Fleet Manager
CISA published an advisory on Rockwell Automation OTTO Fleet Manager, saying a bcrypt work-factor issue could make stored password hashes easier to crack if a backup is exposed.
CISA warns of Fuel-Boss flaws that could let attackers execute code remotely
CISA says some Fuel-Boss versions can be fixed, while others still lack a remedy and should be taken off the Internet or limited by IP access.
CISA republishes Mitsubishi Electric CNC advisory on CVE-2025-2399
CISA republished Mitsubishi Electric’s CNC Series advisory for a medium-severity vulnerability, CVE-2025-2399, and listed fixes and mitigations for affected products.
CISA warns of Mitsubishi Electric flaw that can disrupt industrial communications
CISA republished Mitsubishi Electric’s advisory on a remotely exploitable UDP flaw that can disrupt several industrial automation products and requires vendor fixes or mitigations.
Labor Department issues FAQ guidance on wellness program rewards and disclosures
The Labor Department says new FAQ guidance with HHS and Treasury addresses reward timing and disclosure rules for health-contingent wellness programs.