Multiple ICS Flaws in Pharos and Schneider Electric Systems

Affected Environment
Pharos Mosaic Show Controller, Schneider EcoStruxure Foxboro DCS, and Plant iT/Brewmaxx 9.60+ are affected. These systems are typically used in industrial control and process environments.

Threat Overview
Unauthenticated root commands, unsafe deserialization, and Redis flaws may allow remote code execution. Impacts include loss of confidentiality, integrity, availability, and possible unauthorized system control.

Exposure Timeline
Vulnerabilities are documented in CISA ICS advisories ICSA-26-083-01, -02, and -03 dated 2026. Smarttech247 issued this threat report on 25 March 2026 for timely enterprise review.

Attack Surface
Exposure exists on Mosaic controllers, Foxboro DCS workstations, and Plant iT/Brewmaxx Redis components. Risk increases where systems are network-accessible, use removable media, or accept external project files.

Technical Root Cause
Pharos Mosaic lacks authentication for a critical function, enabling root-level command execution. Foxboro uses unsafe deserialization; Plant iT/Brewmaxx relies on vulnerable Redis Lua handling.

Exploitation Pathway
Pharos can be attacked remotely by unauthenticated actors sending crafted commands to the controller. Foxboro requires an authenticated admin opening a malicious project file; Plant iT via authenticated Redis Lua.