This Patch Tuesday, Siemens, Schneider Electric, Aveva, and Phoenix Contact released advisories for multiple vulnerabilities in their industrial control system and operational technology products. Siemens disclosed a critical authorization bypass vulnerability in Industrial Edge Devices exploitable by unauthenticated remote attackers, along with high-severity issues in Ruggedcom, ET 200SP, and TeleControl Server Basic. Schneider Electric reported privilege escalation and arbitrary code execution flaws in EcoStruxure Process and Power Build Rapsody products, including vulnerabilities in third-party components like Zigbee and Redis. Phoenix Contact disclosed a high-severity command injection vulnerability in TC Router and Cloud Client routers requiring elevated privileges or user interaction. Aveva identified seven vulnerabilities in Process Optimization software enabling remote code execution, privilege escalation, and sensitive data exposure. Vendor advisories include patches and mitigations for these issues.

The vulnerabilities impact critical industrial control and operational technology products, potentially allowing unauthorized access, privilege escalation, remote code execution, command injection, and sensitive data disclosure. Some flaws can be exploited remotely without authentication, while others require elevated privileges or user interaction. These issues could disrupt industrial processes or compromise sensitive operational data if exploited.

Vendor advisories provide official patches and fixes for the reported vulnerabilities. Organizations using affected Siemens, Schneider Electric, Aveva, and Phoenix Contact products should apply the provided updates promptly. Since these are industrial control system products, follow vendor instructions carefully to avoid operational disruptions. No advisories indicate that no action is required or that vulnerabilities are already mitigated without patching. Patch status is confirmed by vendor advisories indicating fixes are available.