Samsung HVAC DMS multiple RCE vulnerabilities

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Six vulnerabilities in Samsung HVAC DMS allow unauthenticated remote code execution and arbitrary file operations; no public exploitation reported.

CISA published an advisory on Samsung HVAC DMS, a software management platform for HVAC systems deployed across commercial facilities and critical manufacturing worldwide. Six vulnerabilities spanning versions 2.0.0 through 2.9.3.5 allow unauthenticated remote code execution via deserialization of untrusted data and execution-after-redirect flaws, plus authenticated and network-restricted arbitrary file creation and deletion via path traversal. The most critical issue (CVE-2025-53078) is a deserialization flaw permitting arbitrary code execution through file write operations; CVE-2025-53077 allows unauthenticated limited-privilege execution. Four additional CVEs enable file read, creation, and deletion by authenticated or local-network-restricted attackers. CVSS v4 scores range from 6.1 to 7.5.

Samsung states the product is not intended for internet connection and should operate on isolated dedicated networks only. No active exploitation in the wild has been reported to CISA, though the vendor notes high attack complexity on some vectors. Claroty Team82 reported all six flaws. Mitigations include applying vendor updates via Samsung support and network isolation; CISA recommends control-system defense-in-depth practices including firewall segmentation, VPN for remote access, and restricted internet exposure.

title: Path Traversal Sequences in Web Request Targeting File Operations
description: Detects web requests with directory traversal sequences in the URI or
  query that return HTTP 200. Matches the path traversal file creation, deletion and
  read primitives described for HVAC DMS-style management web apps. Tune by scoping
  to the affected management server.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-query|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e%5c'
    - ..%2f
    - ..%5c
    - '%252e%252e'
  selection_stem:
    cs-uri-stem|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e%5c'
    - ..%5c
  selection_status:
    sc-status: 200
  condition: 1 of selection_traversal or selection_stem and selection_status
falsepositives:
- Vulnerability scanners run by the security team against internal management servers
- Web applications that legitimately pass relative paths in query parameters
level: medium
id: 862c4364-8d0f-5c3a-afe5-ef864378fa22
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-210-02

title: Java or Web Server Process Spawning Command Shell
description: Detects Java/Tomcat/IIS worker processes spawning cmd, PowerShell or
  script hosts. Generalises on the parent/child relation expected after unauthenticated
  deserialization RCE or webshell drop on a management web application.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat7.exe
    - \tomcat8.exe
    - \tomcat9.exe
    - \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  condition: selection
falsepositives:
- Java-based management or build software that shells out to cmd.exe for maintenance
  scripts
- Application servers launching batch files for scheduled housekeeping
level: medium
id: 92d5c9ef-2110-5bdd-9577-bc88f41f810f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-210-02

title: Web or Java Server Process Launching Download Utility
description: Detects Java/Tomcat/IIS worker processes spawning certutil, bitsadmin,
  curl or PowerShell with download arguments, indicating ingress tool transfer following
  RCE on a web-facing management platform.
tags:
- attack.command-and-control
- attack.t1105
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \tomcat7.exe
    - \tomcat8.exe
    - \tomcat9.exe
    - \w3wp.exe
  selection_tools:
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - DownloadFile
    - DownloadString
    - Invoke-WebRequest
    - 'iwr '
    - Net.WebClient
    - Start-BitsTransfer
  condition: selection_parent and (selection_tools or selection_ps)
falsepositives:
- Java-based update agents invoking curl to fetch patches
- Administrators running certutil from a Java-hosted management console
level: high
id: ba6146a4-8db9-5edf-adfe-449d1375b833
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-210-02

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-210-02