Siemens and other ICS vendors publish new vulnerability advisories
Original title: ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure
Node2Shell exploitation attempts have been seen, but Siemens reports no attacks aimed at its products.
Siemens published nine advisories covering 10 vulnerabilities, including two on Node2Shell exposure, and said patches are unavailable for several products. Schneider Electric, VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy also issued industrial advisories, some tied to PHP2Shell or third-party components. Impacts described include code injection, arbitrary code execution, unauthorized data access, and system compromise.
Unconfirmed: Exploitation attempts of Node2Shell were spotted, but there is no indication of attacks specifically targeting Siemens products.
- Siemens advisories cover ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA, PCS 7, Meta-iot2050, and WinCC Graphics Designer.
- A low-severity Fortigate NGFW issue affects Ruggedcom APE1808.
- Schneider's EcoStruxure Power Build Rapsody issue is medium severity and involves malicious files.
- Johnson Controls described EasyIO Neo IO Manager and a C•CURE 9000 3.20 / Victor 8.0 installer issue.
Impact: Code execution, unauthorized data access, or system compromise
| Product | Affected |
|---|---|
| Siemens | — |
| Schneider Electric EcoStruxure Power Build Rapsody | — |
| Siemens Ruggedcom APE1808 Fortigate NGFW | — |
| Johnson Controls EasyIO Neo IO Manager | — |
| Johnson Controls C•CURE 9000 3.20 / Victor 8.0 installer | 3.20 / 8.0 |
- 1.Apply Siemens' recommended mitigations where patches are not yet available.
- 2.Review vendor advisories for Node2Shell and PHP2Shell exposure.
From the original article
2 min read at securityweek.com
Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. The post ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.