This paper deals with the vulnerability analysis of cyber-physical systems subject to malicious actions. For this purpose, the considered system is assumed to be abstracted as a discrete event system. Labeled finite automata with inputs are used to model the system's behavior along with the information that circulates in both the input and output channels. In particular, we study here stealthy, i.e., undetectable, cyber-attacks that aim to drive the system from a given normal state to a set of forbidden states. We assume that the attacker has limited resources, i.e., a credit, to insert and delete control and sensors events. The proposed analysis evaluates the costs of such attacks on the controlled system depending on its structure, the cost of the malicious actions and possible uncertainties that may affect those costs. It provides systematic methods that aim to compute attacks of minimal cost and robust attacks that are weakly impacted by uncertainties. A case study representing a manufacturing plant is considered to illustrate the results.