Eclipse Foundation Eclipse Milo
Eclipse Milo versions >=0.6.0 and <=1.1.4 have vulnerabilities allowing data deletion, credential recovery, and denial
Run Eclipse Foundation?
Get an email when a reviewed story names Eclipse Foundation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Eclipse Foundation has released an advisory for vulnerabilities in Eclipse Milo, affecting versions from 0.6.0 up to 1.1.4. Successful exploitation could lead to data deletion, credential recovery, user impersonation, or denial of service. CISA recommends updating to Eclipse Milo 1.1.5 or later, and implementing network exposure minimization and secure remote access practices.
The lesson from this incident
Full lessonMultiple vulnerabilities in Eclipse Milo (versions 0.6.0 through 1.1.4) expose OPC UA implementations to serious risks including data deletion, credential recovery, user impersonation, and denial of service. These flaws highlight the critical importance of maintaining up-to-date dependencies in industrial and IoT communication frameworks, where exploitation can have operational and safety consequences. Organizations relying on Eclipse Milo in SCADA, ICS, or other operational technology environments are especially at risk if network exposure is not minimized. Delayed patching in environments using open-source middleware libraries is a persistent and dangerous gap in many vulnerability management programs.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.