Siemens and Schneider Electric’s Patch Tuesday advisories for November 2023 address roughly 90 vulnerabilities affecting their products.
Siemens
Siemens has released 14 new advisories to inform customers about more than 80 vulnerabilities, many of which impact third-party components.
Critical vulnerabilities have been addressed in Simatic MV500 stationary optical readers, the Sinec PNI device initialization program, Siprotec protection devices, Scalance routers, and the Desigo CC building management system.
The industrial giant has informed customers about high-severity vulnerabilities in Scalance communication devices, security software from Nozomi Networks that is used in Ruggedcom devices, Simatic PCS Neo distributed control systems (DCS), the Simcenter Femap simulation application, the Tecnomatix Plant Simulation software, the Mendix Studio Pro development platform, and the Siemens OPC UA Modeling Editor.
Exploitation of these vulnerabilities can lead to arbitrary code execution, denial-of-service (DoS) attacks, file and information exposure, and privilege escalation.
Siemens has released or plans on releasing patches for many of these vulnerabilities, but some products will not receive fixes.
Schneider Electric
Schneider Electric has released three new advisories to inform customers about the availability of patches for five vulnerabilities.
In EcoStruxure Power products, the company addressed a high-severity vulnerability that can be exploited to redirect users to an arbitrary domain, and a medium-severity flaw that can be leveraged for arbitrary JavaScript execution through a cross-site scripting (XSS) attack.
In PowerLogic products, Schneider patched a high-severity issue that can be exploited to upload malicious firmware to a device, and a medium-severity bug that can be leveraged by an attacker with elevated privileges to compromise the user’s browser.
The third advisory describes one medium-severity flaw that can lead to file system enumeration and file downloads in Galaxy UPS devices.
Related: ICS Patch Tuesday: Siemens Ruggedcom Devices Affected by Nozomi Component Flaws
Related: ICS Patch Tuesday: Siemens Fixes 7 Vulnerabilities in Ruggedcom Products
