ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

This Patch Tuesday, Siemens published 17 advisories addressing multiple vulnerabilities in ICS products such as Simatic S7-1500 CPUs, Industrial Edge devices, Ruggedcom Crossbow SAC, and others, including critical issues affecting the GNU/Linux subsystem of Simatic CPUs. Schneider Electric disclosed two high-severity vulnerabilities: one enabling device takeover via malicious web pages on Pro-face STW6000 and Harmony STW6, and another allowing privileged users to install malicious firmware on Sage RTUs. Rockwell Automation fixed two vulnerabilities in 1732E ArmorBlock, including a critical unauthenticated password change flaw that can lead to admin account takeover and a denial-of-service issue. ABB highlighted a dynovaPRO credential reset bypass vulnerability with signs of reconnaissance but no known exploitation. Additional advisories from CISA and Germany’s CERT@VDE address other ICS vulnerabilities. Siemens has released patches for some vulnerabilities and provided mitigations for others pending permanent fixes.

The vulnerabilities affect critical ICS components used in industrial environments, potentially allowing unauthorized access, device takeover, firmware manipulation, denial-of-service, and information disclosure. The critical Rockwell ArmorBlock flaw enables unauthenticated attackers to change web server passwords, risking full administrative control. Siemens’ vulnerabilities impact multiple products including CPUs and network devices, with some critical issues in the GNU/Linux subsystem. Schneider Electric’s flaws could lead to device takeover or malicious firmware installation. ABB’s dynovaPRO vulnerability could allow account takeover via credential reset bypass, with evidence of probing activity. These issues could disrupt industrial operations or compromise system integrity if exploited.

Siemens has released patches for some vulnerabilities and provided mitigations for others until permanent fixes are available; customers should apply patches and follow Siemens’ guidance. Schneider Electric and Rockwell Automation have issued advisories with patches or recommended mitigations; affected users should update devices accordingly. ABB advises monitoring for suspicious activity related to the dynovaPRO credential reset vulnerability. Organizations should track advisories from CISA and CERT@VDE for ongoing updates. No indication of in-the-wild exploitation has been confirmed for these vulnerabilities, but timely application of patches and mitigations is recommended.