Siemens, Schneider Electric, and Rockwell Automation published new security updates and warnings for industrial control systems during the Patch Tuesday cycle, focusing on vulnerabilities that could affect controllers, endpoint devices, and operational platforms used in industrial environments.
17 advisories from Siemens
Siemens issued 17 new security advisories. The response included patches for some vulnerabilities and temporary mitigation measures for others until final fixes become available.
The critical vulnerabilities affected some Simatic S7-1500 central processing units, Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller (SAC). In Simatic units, more than 400 vulnerabilities affect the GNU/Linux subsystem.
Siemens also addressed high-severity vulnerabilities in Ruggedcom Crossbow, Simatic IPC, PSS(R)SINCAL, and the .NET library for the Simatic S7 Webserver API, in addition to Industrial Edge App Publisher, Apogee, Desigo, Talon, Ruggedcom APE1808, and Simatic WinCC. The updates addressing medium-severity vulnerabilities covered the Sentron 3NA COM Fuse and Capital Embedded AR Classic products, along with a clarification of an ambiguity in documentation concerning Simatic S7 units and related products.
Vulnerabilities in Schneider and Rockwell products
Schneider Electric published two new advisories, each covering a high-severity vulnerability. The first affects Pro-face STW6000 and Harmony STW6 and could allow an attacker to take control of the device by tricking the user into visiting a malicious webpage. The second affects Sage RTU units and can be exploited by a user with elevated privileges to install malicious firmware on the device.
Rockwell Automation issued one advisory concerning two vulnerabilities in 1732E ArmorBlock devices. The vulnerability classified as critical allows an unauthenticated attacker to change the web server password, which could lead to takeover of the administrator account. The second vulnerability causes a denial of service.
Warnings from security organizations
CISA published two new advisories: the first concerns vulnerabilities in Swann SWIFI-SE2KIC cameras that could expose video information, while the second addresses a privilege-escalation issue in Inductive Automation’s Ignition product. Germany’s CERT@VDE also reported an information-disclosure vulnerability in the Bender Customer&Partner platform.
During the period between the current and previous Patch Tuesday cycles, advisories were also issued by Moxa, Honeywell, Hitachi Energy, Johnson Controls, and ABB, covering products including protocol gateways, asset management systems, and industrial control systems.
Why does this matter?
The volume and diversity of the advisories show that securing industrial control systems is not limited to installing a single update; some cases may require applying temporary mitigations, reviewing access settings, and monitoring logs until a patch is released. The ArmorBlock vulnerability highlights the importance of protecting device management interfaces, because changing a web server password without authentication could turn a flaw in an endpoint device into a path to an administrative account.
In the case of ABB’s dynovaPRO vulnerability, the company said it was unaware of any active exploitation, but had internally observed 26 password-change operations affecting 9 customers, activity that could indicate testing or reconnaissance. The article therefore recommended that organizations regularly follow CISA and CERT@VDE advisories, while noting that the source does not establish that these vulnerabilities have actually been exploited.