Johnson Controls C-CURE 9000 and Victor application server

CISA ICS advisory bundle describing multiple vulnerabilities across OT/ICS products from Johnson Controls, Weintek, Panduit/Pronetiqs, MZ Automation, Tycon Systems, and others. Issues include remote code execution and SSRF (C-CURE 9000 / Victor), authentication bypass, cleartext credential storage, privilege escalation, stack/heap buffer overflows, out-of-bounds reads, and denial-of-service conditions. Affected components span application servers, HMIs, protocol libraries (IEC 61850, IEC 60870), and web management interfaces with CVSS scores up to 10.0. Deployments are worldwide across several