Major industrial players Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have released new advisories as part of the latest Patch Tuesday, addressing recently discovered vulnerabilities in their industrial control systems (ICS) products.
Schneider Electric’s Advisory Updates
Schneider Electric has issued six new advisories, each concerning distinct vulnerabilities. High-severity issues have been identified in EcoStruxure IT Data Center Expert due to hardcoded credentials, as well as in EcoStruxure Power Monitoring Expert and Power Operation, where local arbitrary code execution is possible. Furthermore, EcoStruxure Automation Expert is affected by vulnerabilities that could lead to command execution and full system compromise.
Additional medium-severity vulnerabilities have been patched in Modicon controllers, which were susceptible to denial-of-service attacks and account takeovers via cross-site scripting (XSS), and in EcoStruxure Foxboro DCS, which faced remote code execution risks.
Siemens’ Critical Vulnerability Fixes
Siemens addressed significant vulnerabilities, including a critical stored XSS flaw in Simatic S7-1500 devices and a potentially serious misconfiguration issue in Mendix applications. Moreover, Siemens notified users of vulnerabilities stemming from third-party components such as Fortinet and OpenSSL.
Other patched vulnerabilities by Siemens include high- and medium-severity issues in the Sicam Siapp SDK, while a low-severity flaw was resolved in Heliox EV chargers.
Updates from Mitsubishi Electric and Moxa
Mitsubishi Electric released a new advisory detailing a remotely exploitable denial-of-service vulnerability affecting its Numerical Control Systems, including the C80, M800, M800V, and M700V series. Earlier, the company alerted customers to several remotely exploitable DoS vulnerabilities in MELSEC iQ-F Series controllers.
Moxa announced four new advisories, with three addressing vulnerabilities found in Intel products. The fourth advisory clarified that Moxa products are unaffected by a recent GNU Inetutils vulnerability.
Broader Cybersecurity Updates
The Cybersecurity and Infrastructure Security Agency (CISA) also published ICS advisories this Patch Tuesday, highlighting vulnerabilities in Ceragon Siklu MultiHaul, Lantronix EDS3000PS and EDS5000, and Apeman cameras. Additionally, a new advisory was issued for a Honeywell building controller vulnerability, which has been the subject of a dispute regarding its impact.
Germany’s VDE-CERT released advisories for vulnerabilities in Codesys, Janitza, and Weidmueller products, some of which allow remote, unauthenticated attackers to fully compromise targeted systems.
As cyber threats in industrial environments continue to evolve, these updates underscore the critical need for organizations to promptly apply security patches to safeguard their systems.
