Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

2023 ICS Patch Tuesday Debuts With 12 Security Advisories From Siemens, Schneider

The first ICS Patch Tuesday of 2023 brings a dozen security advisories from Siemens and Schneider Electric, addressing a total of 27 vulnerabilities.

The first ICS Patch Tuesday of 2023 brings a dozen security advisories from Siemens and Schneider Electric, addressing a total of 27 vulnerabilities.

Siemens

Siemens has published six new advisories that describe a total of 20 vulnerabilities. Security updates are available for many of the affected products, but some will not get patches.

Based on CVSS score — note that CVSS scores can be misleading for ICS vulnerabilities — the most important advisory describes a dozen flaws in Sinec INS (Infrastructure Network Services).

The security holes, all rated ‘critical’ or ‘high severity’, could allow an attacker to read and write

arbitrary files, which could ultimately lead to malicious code execution on the device. Some of the vulnerabilities impact third-party components.

Another advisory describes a critical reflected cross-site scripting (XSS) vulnerability in the Mendix SAML module. An attacker can exploit the weakness to obtain sensitive information by tricking the targeted user into clicking on a link, but exploitation is only possible on certain non-default configurations.

Siemens has informed customers about two high-severity vulnerabilities in Automation License Manager. One issue can allow an unauthenticated attacker to remotely rename and move files, while the other can be exploited for remote code execution if chained with the first vulnerability.

Remote code execution vulnerabilities have been patched in JT Open Toolkit, JT Utilities and Solid Edge. Exploitation involves getting the targeted user to open a specially crafted file.

Researchers have found a hardware issue in S7-1500 CPUs that can allow an attacker with physical access to a device to replace the boot image and execute arbitrary code.

“Siemens has released new hardware versions for several CPU types of the S7-1500 product family in which this vulnerability is fixed and is working on new hardware versions for remaining PLC types to address this vulnerability completely,” Siemens said.

Schneider Electric

Schneider Electric has also released six new advisories, but they only cover a total of seven vulnerabilities.

The company has informed customers about the availability of patches for critical and high-severity vulnerabilities in the EcoStruxure Geo SCADA Expert product, which can be exploited for DoS attacks and obtaining sensitive information.

In its EcoStruxure Power Operation and Power SCADA Operation software, the industrial giant found a high-severity issue that can be exploited for DoS attacks.

EcoStruxure Power SCADA Anywhere is affected by a high-severity flaw that can be leveraged for OS command execution, but exploitation requires authentication.

EcoStruxure Control Expert, EcoStruxure Process Expert and Modicon PLCs are impacted by a vulnerability that could allow arbitrary code execution and DoS attacks using specially crafted project files. These products are also impacted by an authentication bypass flaw.

Lastly, the EcoStruxure Machine Expert HVAC product is affected by a medium-severity information disclosure issue.

Related: ICS Patch Tuesday: Siemens Addresses Critical Vulnerabilities

Related: ICS Patch Tuesday: Siemens Fixes 80 OpenSSL, OpenSSH Flaws in Switches

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.