ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
ABB previously published an advisory warning about possible probing of a dynovaPRO vulnerability.
Industrial giants Siemens, Schneider Electric, and Rockwell Automation have published ICS security advisories this Patch Tuesday.
Siemens published 17 new advisories this Patch Tuesday. The company has released patches for some of the vulnerabilities, while for others it has shared mitigations until permanent fixes become available.
The company addressed critical vulnerabilities in some Simatic S7-1500 CPUs, Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller (SAC). For Simatic CPUs, more than 400 flaws affect the GNU/Linux subsystem.
Siemens addressed high-severity issues in Ruggedcom Crossbow, Simatic IPC, PSS(R)SINCAL, the .NET Client Library for Simatic S7 Webserver API, Industrial Edge App Publisher, Apogee, Desigo, Talon, Ruggedcom APE1808, and Simatic WinCC products.
Medium-severity issues have been patched in Sentron 3NA COM Fuse and Capital Embedded AR Classic.
Siemens also informed customers about a documentation ambiguity affecting Simatic S7 PLCs and related products.
Schneider Electric released two new advisories, each covering one high-severity vulnerability. The first affects Pro-face STW6000 and Harmony STW6 and could allow an attacker to take control of a device by tricking the targeted user into visiting a malicious webpage.
The second affects Sage RTUs and it can be leveraged by a privileged user to install malicious firmware on a device.
Rockwell Automation published one new advisory on Tuesday. It informs customers about two vulnerabilities in 1732E ArmorBlock.
One of them, rated ‘critical’, allows an unauthenticated attacker to change a device’s web server password, which can lead to admin account takeover. The second flaw is a DoS issue.
CISA published two new ICS advisories on Tuesday: one covers Swann SWIFI-SE2KIC camera vulnerabilities exposing video information, and the other covers a privilege escalation issue in Inductive Automation’s Ignition product.
Germany’s CERT@VDE has published one new advisory to inform organizations about an information disclosure vulnerability affecting Bender’s Customer&Partner platform.
Between this and the previous Patch Tuesday, advisories were published by Moxa (two severe protocol gateway vulnerabilities), Honeywell (Pro-Watch), Hitachi Energy (Asset Suite, RTU500, MicroSCADA), Johnson Controls (ADVMS, Illustra Standard, EasyIO), and ABB (Automation Builder, Mint Workbench, AC500, Protection and Control IED Manager, Freelance, and dynovaPRO).
Regarding the dynovaPRO vulnerability, which could allow account takeovers via a bypass in the credential reset flow, ABB said it’s not aware of any in-the-wild exploitation, but added: “Internal log analysis identified 26 password change events affecting 9 customers, which may indicate testing or reconnaissance activity.”
Organizations should closely monitor CISA and CERT@VDE, which regularly publish ICS advisories.
