Multiple ICS Flaws in Pharos and Schneider Electric Systems

Executive Summary

Unauthenticated root commands, unsafe deserialization, and Redis flaws may allow remote code execution. Impacts include loss of confidentiality, integrity, availability, and possible unauthorized system control.

Key Details

Affected Platform

Attack Surface

Network accessible, unauthenticated

Recommended Action

Apply vendor patch

Affected Environment

Pharos Mosaic Show Controller, Schneider EcoStruxure Foxboro DCS, and Plant iT/Brewmaxx 9.60+ are affected. These systems are typically used in industrial control and process environments.

Operational Impact

Attackers may run code, alter configurations, crash services, or cause denial of service on control systems. This can disrupt industrial processes and compromise reliability of plant operations.

Technical Root Cause

Pharos Mosaic lacks authentication for a critical function, enabling root-level command execution. Foxboro uses unsafe deserialization; Plant iT/Brewmaxx relies on vulnerable Redis Lua handling.

Recommended Mitigation

Upgrade Mosaic to firmware 2.16+, Foxboro DCS to CS 8.1, and apply ProLeiT-2025-001 for Plant iT/Brewmaxx.
Then disable risky Redis eval commands, enforce secure configs, and reboot affected systems.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore MDR for OT

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Use CISA advisories ICSA-26-083-01, -02, and -03 for full technical details and vendor guidance. Track CVEs 2026-2417, 2026-1286, 2025-49844, 46817, 46818, and 46819 in your vulnerability management.