Serial number:AV25-424
Date:July 15, 2025

On July 15, 2025, VMware published a security advisory to address vulnerabilities in the following products:

• VMware Cloud Foundation – version 9.0.0.0
• VMware vSphere Foundation – version 9.0.0.0
• VMware ESXi – version 8.0
• VMware ESXi – version 8.0
• VMware ESXi – version 7.0
• VMware Workstation – version 17.x
• VMware Fusion – version 13.x
• VMware Cloud Foundation – version 5.x
• VMware Cloud Foundation – version 4.5.x
• VMware Telco Cloud Platform – versions 5.x and 4.x
• VMware Telco Cloud Platform – versions 3.x and 2.x
• VMware Telco Cloud Infrastructure – versions 3.x and 2.x
• VMware Tools [1] – version 13.x.x
• VMware Tools [1] – versions 12.x.x and 11.x.x
• VMware Tools – versions 13.x.x, 12.x.x and 11.x.x
• VMware Tools – versions 13.x.x, 12.x.x and 11.x.x

The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.

• VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)
• Security Advisories - VMware Cloud Foundation

Serial number:AV25-423
Date:July 15, 2025

On July 15, 2025, Zyxel published a security advisory to address a vulnerability in the following products:

• NWA50AX – versions prior to 7.10(ABYW.1)
• NWA50AX PRO – versions prior to 7.10(ACGE.2)
• NWA55AXE – versions prior to 7.10(ABZL.1)
• NWA90AX – versions prior to 7.10(ACCV.1)
• NWA90AX PRO – versions prior to 7.10(ACGF.2)
• NWA110AX – versions prior to 7.10(ABTG.1)
• NWA130BE – versions prior to 7.10(ACIL.2)
• NWA210AX – versions prior to 7.10(ABTD.1)
• NWA220AX-6E – versions prior to 7.10(ACCO.1)
• NWA1123AC PRO – versions prior to 6.28(ABHD.3)
• WAC500H – versions prior to 6.70(ABWA.6)
• WAC5302D-Sv2 – versions prior to 6.25(ABVZ.9)
• WAC6103D-I – versions prior to 6.28(AAXH.3)
• WAX300H – versions prior to 7.10(ACHF.1)
• WAX510D – versions prior to 7.10(ABTF.1)
• WAX610D – versions prior to 7.10(ABTE.1)
• WAX620D-6E – versions prior to 7.10(ACCN.1)
• WAX630S – versions prior to 7.10(ABZD.1)
• WAX640S-6E – versions prior to 7.10(ACCM.1)
• WAX650S – versions prior to 7.10(ABRM.1)
• WAX655E – versions prior to 7.10(ACDO.1)
• WBE530 – versions prior to 7.10(ACLE.2)
• WBE660S – versions prior to 7.10(ACGG.2)

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Zyxel security advisory for path traversal vulnerability in Aps (CVE-2025-6265)
• Zyxel Advisories

Serial number:AV25-422
Date:July 14, 2025

Between July 9 and 11, 2025, VMware published security advisories to address vulnerabilities in the following products:

• VMware Tanzu Greenplum – version 7.5.0
• VMware Tanzu GemFire – version 9.15.16
• VMware Tanzu Greenplum – version 6.30.0
• VMware Tanzu for Valkey – version 8.1.2
• VMware Tanzu for Postgres on Kubernetes – version 4.2.1

The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.

• Security Advisories – TNZ-2025-0031
• Security Advisories – TNZ-2025-0042
• Security Advisories – TNZ-2025-0043
• Security Advisories – TNZ-2025-0044
• Security Advisories – TNZ-2025-0045
• Security Advisories – Tanzu

Serial number:AV25-406
Date: July 8, 2025

Updated: July 14, 2025

On July 8, 2025, Fortinet published security advisories to address vulnerabilities in multiple products. Included were updates for the following:

• FortiAnalyzer – multiple versions
• FortiAnalyzer Cloud – multiple versions
• FortiIsolator – multiple versions
• FortiManager – multiple versions
• FortiManager Cloud – multiple versions
• FortiOS 7.6 – versions 7.6.0 to 7.6.1
• FortiOS 7.4 – versions 7.4.0 to 7.4.7
• FortiOS 7.2 – versions 7.2.0 to 7.2.11
• FortiOS 7.0 – versions 7.0.1 to 7.0.16
• FortiProxy 7.6 – versions 7.6.0 to 7.6.1
• FortiProxy 7.4 – versions 7.4.0 to 7.4.8
• FortiProxy 7.2 – versions 7.2.0 to 7.2.13
• FortiProxy 7.0 – versions 7.0.0 to 7.0.20
• FortiSandbox – multiple versions
• FortiVoice 6.4 – versions 6.4.0 to 6.4.10
• FortiVoice 7.0 – versions 7.0.0 to 7.0.6
• FortiVoice 7.2 – versions 7.2.0
• FortiWeb – multiple versions

Update 1

CVE-2025-25257: Unauthenticated SQL injection in GUI affecting:

• FortiWeb 7.6 – versions 7.6.0 to 7.6.3
• FortiWeb 7.4 – versions 7.4.0 to 7.4.7
• FortiWeb 7.2 – versions 7.2.0 to 7.2.10
• FortiWeb 7.0 – versions 7.0.0 to 7.0.10

• Fortinet PSIRT – FG-IR-25-151
   

  The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

  • Fortinet PSIRT Advisories

Serial number:AV25-421
Date:July 14, 2025

Between July 7 and 13, 2025, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:

• Red Hat CodeReady Linux Builder – multiple versions and platforms
• Red Hat Enterprise Linux – multiple versions and platforms
• Red Hat Enterprise Linux Server – multiple versions and platforms
• Red Hat Enterprise Linux Server for Power LE – multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Red Hat Security Advisories

Serial number:AV25-420
Date:July 14, 2025

Between July 7 and 13, 2025, CISA published ICS advisories to address vulnerabilities in the following products:

• Advantech iView – versions prior to 5.7.05 build 7057
• Delta Electronics DTM Soft – versions 1.6.0.0 and prior
• Emerson ValveLink DTM – versions prior to ValveLink 14.0
• Emerson ValveLink PRM – versions versions prior to ValveLink 14.0
• Emerson ValveLink SNAP-ON – versions prior to ValveLink 14.0
• Emerson ValveLink SOLO – versions prior to ValveLink 14.0
• End-of-Train and Head-of-Train remote linking protocol – all versions
• KUNBUS Revolution Pi OS Bullseye – version 02/2024
• KUNBUS Revolution Pi OS Bullseye – version 04/2024
• KUNBUS Revolution Pi OS Bullseye – version 06/2023
• KUNBUS Revolution Pi OS Bullseye – version 07/2023
• KUNBUS Revolution Pi OS Bullseye – version 09/2023
• KUNBUS Revolution Pi Webstatus – versions 2.4.5 and prior
• Siemens SIMATIC CN 4100 – versions prior to V4.0
• Siemens SINEC NMS – version prior to V4.0
• Siemens SIPROTEC 5 – multiple versions and models
• Siemens Solid Edge SE2025 – version prior to V225.0 Update 5
• Siemens TIA Administrator – versions prior to V3.0.6
• Siemens TIA Project-Server V17 – all versions
• Siemens TIA Project-Server – versions prior to V2.1.1
• Siemens Totally Integrated Automation Portal (TIA Portal) V17 – all versions
• Siemens Totally Integrated Automation Portal (TIA Portal) V18 – all versions
• Siemens Totally Integrated Automation Portal (TIA Portal) V19 – all versions
• Siemens Totally Integrated Automation Portal (TIA Portal) V20 – versions prior to V20 Update 3

The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.

• CISA ICS Advisories

Serial number:AV25-419
Date:July 14, 2025

Between July 7 and 13, 2025, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:

• Ubuntu 14.04 LTS
• Ubuntu 16.04 LTS
• Ubuntu 18.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 24.04 LTS
• Ubuntu 24.10
• Ubuntu 25.04

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Ubuntu Security Notices

Serial number:AV25-418
Date:July 14, 2025

Between July 7 and 13, 2025, Dell published security advisories to address vulnerabilities in the following products:

• Dell PowerFlex Manager – version 4.6.2 and prior
• Dell UCC Edge – versions prior to 3.0.1

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Dell Security Advisories – DSA-2025-279
• Dell Security Advisories – DSA-2025-180
• Dell Security advisories and notices

Serial number:AV25-417
Date:July 14, 2025

Between July 7 and 13, 2025, IBM published security advisories to address vulnerabilities in multiple products.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• IBM Product Security Incident Response

Serial number:AV25-391
Date: July 3, 2025
Updated: July 10, 2025

On May 14, 2025, Wing FTP a published an update to address a critical vulnerability in the following product:

• Wing FTP Server – version v7.4.3 and prior

Open-source reporting has indicated that proof-of-concept exploit code is available for CVE-2025-47812.

Update 1

On July 10, 2025, open-source reporting indicated that the Wing FTP Remote Code Execution vulnerability CVE-2025-47812 has been actively exploited in the wild. The vulnerability is rated a CVSS 10.0.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Wing FTP Server v7.4.4