1,000 Instantel Industrial Monitoring Devices Possibly Exposed to Hacking

Over 1,000 industrial monitoring devices made by Canada-based Instantel may be exposed to remote hacking due to a critical vulnerability.

An advisory published recently by the cybersecurity agency CISA revealed that Instantel’s Micromate product, which is designed to record vibration, noise, and air overpressure, is affected by a vulnerability related to the lack of authentication on a configuration port.

The flaw, tracked as CVE-2025-1907 with a CVSS score of 9.8, can allow an attacker to execute arbitrary commands on a device.

Souvik Kandar, the Microsec researcher who discovered the security hole, told SecurityWeek that he has identified over 1,000 internet-exposed Micromate devices worldwide that could be vulnerable to attacks.

The vulnerable product is widely used for various applications, including mining, tunneling, bridge monitoring, construction, and environmental safety.

Kandar explained that an attacker who can achieve command execution on a Micromate device could alter or disable its monitoring functionality, leading to false or incomplete data. An attacker could also make modifications to undermine data integrity, potentially causing problems for auditing, compliance, or insurance claims. 

The device can also be corrupted or shut down, which can lead to critical operations such as blasting and tunneling being interrupted, the researcher said.

According to Kandar, an attacker may also be able to leverage a hacked device to move laterally to other connected IT or OT systems.

CISA noted in its advisory that Instantel is working on a firmware update for this vulnerability. Until a patch becomes available, users are advised to limit access to the affected device to trusted IP addresses. 

Instantel has not responded to SecurityWeek’s request for comment.