Product

Desigo CC

1 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 8, 2026 · last 6d ago

Timeline2 articles

ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws

September ICS Patch Tuesday brings critical fixes from Schneider Electric, Siemens, and Aveva, including CVSS 9.2 authentication flaw CVE-2026-3869 in Modicon M580 controllers.

Schneider Electric's September advisories include a critical authentication vulnerability, CVE-2026-3869 with a CVSS score of 9.2, in Modicon M580 and Modicon M580 Safety controllers, plus high-severity bugs in PowerLogic T300 and EcoStruxure IT Data Center Expert. Siemens published nine new advisories, four rated critical across Reyrolle 7SR5, Open Interface Services, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT, and began rolling out fixes for CVE-2026-31431, a 7.8-rated Linux kernel flaw enabling root shell access. Aveva disclosed four flaws in Pipeline Integrity Monitor's PIMBoards, including a hardcoded encryption key and MD5-hashed passwords, plus an unsafe deserialization issue in Enterprise SCADA. Rockwell Automation separately issued nine advisories covering RSLinx Classic and multiple controller products.

SecurityWeekSep 9, 10:49 UTC · 6d agoVulnerability CVE-2026-3869 CVE-2026-31431

[Control Systems] Siemens security advisory (AV26-890)

Canada's Cyber Centre relayed a Siemens advisory affecting Reyrolle 7SR5, Teamcenter, Siveillance Control, Desigo CC and other products.

Advisory AV26-890, dated September 8, 2026, flags Siemens vulnerabilities in Reyrolle 7SR5 (versions prior to V2.70), Teamcenter, Siveillance Control, SIMATIC AX Runtime, Desigo CC, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT across multiple versions and models. The Cyber Centre encourages users and administrators to review the Siemens advisory and apply available updates. No specific CVEs or exploitation details are provided in the relayed advisory.

Canadian Centre for Cyber SecuritySep 8, 17:27 UTC · 7d agoAdvisory

Related CVEsby mentions

CVE-2026-314317.8100%
Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface
CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown).
· Linux kernel (algif_aead / AF_ALG crypto interface) · Red Hat Enterprise Linux (including AUS, EUS, TUS, and Update Services for SAP Solutions) KEV PoC ×5mass
CVE-2026-38699.2—
Flawed Authentication Algorithm in Schneider Electric PLC Enables Full Compromise
CVE-2026-3869 is a critical (CVSS 4.0 score 9.2) incorrect implementation of an authentication algorithm (CWE-303) in a Schneider Electric programmable logic controller (PLC), disclosed and patched as part of Schneider Electric's ICS Patch Tuesday release. The flaw is reachable over the network with no privileges or user interaction required, but it carries elevated attack requirements: it comes into play when the PLC is running an application project with a lower application level, which is the configuration precondition for exploitation. An attacker who meets those conditions can defeat the controller's authentication mechanism and cause a complete loss of confidentiality, integrity and availability of the PLC (VC:H/VI:H/VA:H), meaning they could read, modify or disrupt the running control process. Affected users are operators of the impacted Schneider Electric PLC line; the available data does not name the specific model or firmware versions, so operators should confirm their exposure against the official Schneider notification. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, with no reports of exploitation in the wild to date.
· Schneider Electric PLC (specific model line not identified in the available data)large

Appears with

vendor Siemens 2 organization Siemens 1 product EcoStruxure IT Data Center Expert 1 product Enterprise SCADA 1 product Industrial Edge Management 1 product Modicon M580 1 product PIMBoards 1 product PowerLogic T300 1 product Reyrolle 7SR5 1 organization Canadian Centre for Cyber Security 1 product SIMATIC AX Runtime 1 product Siveillance Control 1 product Teamcenter 1 vendor Aveva 1 vendor CISA 1 vendor Rockwell Automation 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.