Four vulnerabilities spanning four unrelated product categories — an industrial control platform, a cellular gateway, a web browser, and a modern frontend build tool — share nothing in common except one thing: each was confirmed exploited long enough after its original disclosure, or in a context obscure enough, that it illustrates the same underlying truth from a different angle: attackers don't care how old, how niche, or how "development-only" a product is, only whether it's still running unpatched somewhere they can reach.
| CVE | CVSS | Product | Originally Disclosed | Added to KEV |
|---|---|---|---|---|
| CVE-2021-22681 | 9.8 | Rockwell Logix Controllers (multiple) | Mar 2021 | 5 Mar 2026 |
| CVE-2018-4063 | 8.8 | Sierra Wireless AirLink ALEOS | May 2019 | 12 Dec 2025 |
| CVE-2010-3765 | 9.8 | Mozilla Firefox/SeaMonkey/Thunderbird | Oct 2010 | 6 Oct 2025 |
| CVE-2025-31125 | 5.3 | Vite dev server | Mar 2025 | 22 Jan 2026 |
An industrial authentication mechanism that was never actually secret
CVE-2021-22681 is the most severe entry here, and it concerns a design flaw baked into how Rockwell Automation's Studio 5000 Logix Designer software authenticates itself to the Logix controllers it manages. Per NVD, "Studio 5000 Logix Designer... and RSLogix 5000... use a key to verify Logix controllers are communicating with Rockwell Automation" hardware — a long list including CompactLogix, ControlLogix, DriveLogix, Compact GuardLogix, GuardLogix, and SoftLogix product families. The vulnerability, per NVD, is that "an unauthenticated attacker could bypass this verification mechanism and authenticate" directly with the controller. This is a hardcoded or discoverable secret problem (CWE-522, insufficiently protected credentials) sitting at the heart of a widely deployed industrial control system product line — the KEV description notes exploitation "would allow an unauthorized application to connect with Logix controllers," requiring only "network access to the controller," a bar that is lower than it should be in many industrial environments where network segmentation between IT and OT systems remains inconsistent.
An end-of-life cellular gateway that still routes traffic somewhere
CVE-2018-4063 affects Sierra Wireless AirLink ALEOS-based gateways — cellular routers commonly deployed for remote or mobile connectivity in retail, industrial, and transportation settings. NVD describes "an exploitable remote code execution vulnerability... in the upload.cgi functionality," where "a specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver." The KEV entry, like the D-Link cluster elsewhere in this series, flags the affected product as potentially "end-of-life (EoL) and/or end-of-service (EoS)," with the same guidance to discontinue use where mitigation isn't possible. What makes this entry distinct is the device category: a cellular gateway sits at a network chokepoint by design, often providing the only connectivity for a remote site — meaning a compromised unit doesn't just expose itself, it can expose everything behind it that depends on that link.
A fifteen-year-old browser bug and the malware that used it
CVE-2010-3765 is the oldest CVE in this batch by a wide margin, originally disclosed in October 2010. NVD's description ends with a detail rarely included in these records: the vulnerability was exploited "in the wild in October 2010 by the Belmoo malware," meaning this browser memory-corruption bug (in Firefox, SeaMonkey, and Thunderbird's shared rendering engine) was a known, named attack vector within days of disclosure, not a theoretical risk. Its presence in KEV over fifteen years later isn't really about Firefox 3.5 — it's a reminder that legacy systems running genuinely ancient, unsupported software builds (embedded devices, kiosks, industrial HMIs running old browser engines) remain a real, checkable category of risk, however small.
A dev-server default that only matters when you break the one assumption it depends on
CVE-2025-31125 stands apart from the other three: it's recent, it's a modest 5.3 CVSS medium severity, and NVD is careful to scope its actual exploitability tightly: Vite's dev server "exposes content of non-allowed files using ?inline&import or ?raw?import," but "only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected." Vite's dev server is explicitly documented as a development-time tool, not meant for production or public exposure — this vulnerability only bites when that guidance is ignored, whether through misconfiguration, a forgotten debug flag left on, or an internal tool assumed to be "just for the team" that quietly became reachable from outside.
What to check this week
Verify network segmentation between IT and OT systems anywhere Rockwell Logix controllers are deployed, since CVE-2021-22681's exploitation requires only network access — segmentation is the practical control where a full protocol-level fix may not be feasible on older hardware.
Confirm EoL/EoS status for any Sierra Wireless AirLink gateways in the fleet and prioritize replacement of any still providing production connectivity.
Search for any residual legacy browser deployments — embedded systems, kiosks, or older endpoint images — that might still run Firefox, SeaMonkey, or Thunderbird builds old enough to be affected by CVE-2010-3765.
Audit for any Vite dev servers running with --host or server.host enabled, especially in shared or internal-network environments, and disable network exposure unless there's a specific, reviewed reason for it.
A closing note on the range this cluster covers
These four products span industrial automation, cellular networking, desktop software, and modern web tooling — categories that would never otherwise appear in the same conversation. That's precisely the value of reading them together: KEV inclusion isn't a signal about a product category's inherent risk, it's a signal that real-world exploitation was confirmed somewhere, against someone, regardless of how obscure or dated the target.
A final consideration on inventory completeness
The common failure mode across all four of these entries isn't a missing patch so much as a missing entry in whatever asset inventory should have flagged the affected product for review in the first place — old browser builds, EoL cellular gateways, and dev-server flags are exactly the kind of asset that quietly falls outside routine patch management scope.
How Safeguard helps
Safeguard's continuous inventory doesn't discriminate by product category or vendor prominence — industrial control software, embedded gateways, legacy browser builds, and development tooling configurations are all tracked with the same visibility, so that a vulnerability's obscurity or age never becomes the reason it goes unnoticed.
