Critical vulnerability reported in Güralp FMUS seismic monitoring devices
Take action: If you have Güralp FMUS Series seismic monitoring devices, immediately isolate them from the internet and place them on a protected network segment since there's no security patch available. Only allow remote access through a secure VPN if absolutely necessary.
Learn More
CISA is reporting a critical security vulnerability affecting all versions of Güralp Systems' FMUS Series seismic monitoring devices.
This vulnerability is tracked as CVE-2025-8286 (CVSS score 9.8) is caused by exposed unauthenticated Telnet-based command line interface. It enables remote attackers to gain complete control over the seismic monitoring equipment without requiring any form of authentication.
The vulnerability affects all versions of the Güralp FMUS Series seismic monitoring devices currently in use.
Despite CISA's attempts at coordinated disclosure, Güralp Systems did not respond to coordination efforts, leaving users without official vendor guidance or patches at the time of publication.
CISA strongly advises minimizing network exposure for all control system devices and ensuring they are not accessible from the internet. When remote access is absolutely necessary, more secure methods such as Virtual Private Networks should be used.
At the time of CISA's publication on July 31, 2025, no known public exploitation specifically targeting this vulnerability had been reported.
