ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes Critical ArmorBlock Takeover Flaw
Siemens released 17 ICS advisories, while Rockwell Automation patched a critical flaw in its ArmorBlock devices allowing unauthorized takeover.
Industrial giants Siemens, Rockwell Automation, and Schneider Electric have collectively published a significant number of advisories this Patch Tuesday, addressing a wide array of vulnerabilities across their industrial control system (ICS) product lines.
Siemens led the pack with 17 new advisories, detailing fixes for critical, high, and medium-severity vulnerabilities. The company has rolled out patches for some issues, while providing mitigations for others where permanent fixes are still in development. Notably, critical vulnerabilities were addressed in Simatic S7-1500 CPUs, Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller (SAC). The Simatic CPU advisories alone highlighted over 400 flaws within their underlying GNU/Linux subsystems.
High-severity issues patched by Siemens span across various products including Ruggedcom Crossbow, Simatic IPC, PSS(R)SINCAL, the .NET Client Library for Simatic S7 Webserver API, Industrial Edge App Publisher, Apogee, Desigo, Talon, Ruggedcom APE1808, and Simatic WinCC. Medium-severity vulnerabilities were resolved in Sentron 3NA COM Fuse and Capital Embedded AR Classic. Siemens also issued a notice regarding a documentation ambiguity affecting Simatic S7 PLCs and related systems.
Schneider Electric contributed two new advisories, each detailing a high-severity vulnerability. The first impacts Pro-face STW6000 and Harmony STW6 devices, posing a risk of device takeover if a user is tricked into visiting a malicious webpage. The second advisory concerns Sage RTUs, where a privileged user could exploit the vulnerability to install malicious firmware.
Rockwell Automation addressed a critical vulnerability in its 1732E ArmorBlock devices. This flaw, rated 'critical,' allows an unauthenticated attacker to alter the device's web server password, potentially leading to a full administrative account takeover. A secondary denial-of-service (DoS) vulnerability was also detailed in the same advisory.
Beyond these major vendors, CISA published two new ICS advisories: one concerning vulnerabilities in Swann SWIFI-SE2KIC cameras that could expose video information, and another detailing a privilege escalation issue in Inductive Automation's Ignition product. Germany's CERT@VDE also issued an advisory for an information disclosure vulnerability affecting Bender’s Customer&Partner platform.
In related news, ABB warned of potential probing targeting a dynovaPRO vulnerability, which could allow account takeovers via a bypass in the credential reset flow. While ABB stated they are unaware of any in-the-wild exploitation, their internal logs indicated 26 password change events across nine customers, suggesting possible testing or reconnaissance activity.
These extensive updates underscore the ongoing efforts by ICS vendors to secure their operational technology (OT) environments against a persistent threat landscape. Organizations utilizing these industrial systems are strongly advised to review all published advisories and apply patches or implement mitigations as recommended.