The 2022 ICS/OT Vulnerability Briefing Recap
Summary: Dragos reported 2,170 ICS/OT CVEs in 2022, a 27 percent increase over 2021, and found errors in 34 percent of the advisories it analyzed, including CVSS errors in 14.9 percent of their CVEs. Dragos rated 70 percent of CVEs as more severe than their published scores, found 83 percent of vulnerabilities sit deep in the ICS network at Purdue Levels 0 to 3, and reported that 50 percent of advisories could cause both loss of view and loss of control.
Bottom line: Only 2 percent of these vulnerabilities need to be addressed now and 30 percent likely never do, yet 77 percent had no practical mitigation from the vendor or CNA even though 70 percent had a patch at announcement - so the real exposure is the gap between a published patch and a plant that cannot safely shut down to apply it.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026