Siemens and Schneider Electric have addressed a total of nearly 100 vulnerabilities with their February 2023 Patch Tuesday advisories.
Siemens
Siemens has published 13 new advisories covering a total of 86 vulnerabilities.
The most significant vulnerability — based on its CVSS score of 10 — is a memory corruption issue that can lead to a denial-of-service (DoS) condition or arbitrary code execution in the Comos plant engineering software.
This vulnerability was identified by Siemens’ own employees, which is not surprising. According to a recent report from industrial cybersecurity firm SynSaber, Siemens’ product security team self-reported 544 vulnerabilities in 2022, up from 230 in the previous year. It’s worth noting that many of the flaws addressed by Siemens in its products are actually introduced by third-party components.
Siemens has patched roughly a dozen critical and high-severity vulnerabilities in its Brownfield Connectivity product. Exploitation of the flaws can lead to a DoS condition.
Some of the high-severity flaws addressed by Siemens in its latest round of Patch Tuesday advisories are related to the BIOS, specifically vulnerabilities resolved by Intel and Insyde in November 2022, including issues related to a type of attack dubbed RingHopper.
[ Read: Cyber Insights 2023 | ICS and Operational Technology ]
High-severity vulnerabilities that can be exploited for code execution and DoS attacks by tricking targeted users into processing specially crafted files have been patched in Tecnomatix Plant Simulation, JT Open Toolkit, JT Utilities, Parasolid, Solid Edge, and Simcenter Femap.
A security hole in SiPass integrated ACC that can be exploited to escalate privileges to root, and a DoS flaw in some Scalance switches have also been rated ‘high severity’.
For some of the impacted products, Siemens has yet to release fixes.
Schneider Electric
Schneider Electric has published three advisories covering 10 vulnerabilities. One advisory describes nine high- and medium-severity issues discovered in the company’s StruxureWare Data Center Expert monitoring software.
Exploitation of the vulnerabilities can lead to remote code/command execution or privilege escalation.
Another advisory describes one high-severity improper authentication flaw affecting Merten KNX products.
The third advisory informs Schneider Electric customers of a medium-severity issue in EcoStruxure Geo SCADA Expert that can allow hackers to falsify logs.
Related: Siemens License Manager Vulnerabilities Allow ICS Hacking
Related: 2022 ICS Attacks: Fewer-Than-Expected on US Energy Sector, But Ransomware Surged
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- New York Man Arrested for Running BreachForums Cybercrime Website
- Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies
- Mozilla Patches High-Severity Vulnerabilities With Release of Firefox 111
- Microsoft: 17 European Nations Targeted by Russia in 2023 as Espionage Ramping Up
Latest News
- Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- News Analysis: UK Commits $3 Billion to Support National Quantum Strategy
- Malicious NuGet Packages Used to Target .NET Developers
- Google Pixel Vulnerability Allows Recovery of Cropped Screenshots
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
