Connect with us

Hi, what are you looking for?



ICS Patch Tuesday: 90 Vulnerabilities Addressed by Siemens and Schneider Electric

Siemens and Schneider Electric’s Patch Tuesday advisories for November 2023 address 90 vulnerabilities affecting their products. 

ICS Patch Tuesday

Siemens and Schneider Electric’s Patch Tuesday advisories for November 2023 address roughly 90 vulnerabilities affecting their products. 


Siemens has released 14 new advisories to inform customers about more than 80 vulnerabilities, many of which impact third-party components.

Critical vulnerabilities have been addressed in Simatic MV500 stationary optical readers, the Sinec PNI device initialization program, Siprotec protection devices, Scalance routers, and the Desigo CC building management system.

The industrial giant has informed customers about high-severity vulnerabilities in Scalance communication devices, security software from Nozomi Networks that is used in Ruggedcom devices, Simatic PCS Neo distributed control systems (DCS), the Simcenter Femap simulation application, the Tecnomatix Plant Simulation software, the Mendix Studio Pro development platform, and the Siemens OPC UA Modeling Editor.

Exploitation of these vulnerabilities can lead to arbitrary code execution, denial-of-service (DoS) attacks, file and information exposure, and privilege escalation.

Siemens has released or plans on releasing patches for many of these vulnerabilities, but some products will not receive fixes. 

Advertisement. Scroll to continue reading.

Schneider Electric

Schneider Electric has released three new advisories to inform customers about the availability of patches for five vulnerabilities. 

In EcoStruxure Power products, the company addressed a high-severity vulnerability that can be exploited to redirect users to an arbitrary domain, and a medium-severity flaw that can be leveraged for arbitrary JavaScript execution through a cross-site scripting (XSS) attack.

In PowerLogic products, Schneider patched a high-severity issue that can be exploited to upload malicious firmware to a device, and a medium-severity bug that can be leveraged by an attacker with elevated privileges to compromise the user’s browser.

The third advisory describes one medium-severity flaw that can lead to file system enumeration and file downloads in Galaxy UPS devices. 

Related: ICS Patch Tuesday: Siemens Ruggedcom Devices Affected by Nozomi Component Flaws

Related: ICS Patch Tuesday: Siemens Fixes 7 Vulnerabilities in Ruggedcom Products

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


The overall effect of current global geopolitical conditions is that nation states have a greater incentive to target the ICS/OT of critical industries, while...

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...


Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.


Wago has patched critical vulnerabilities that can allow hackers to take complete control of its programmable logic controllers (PLCs).


Cybersecurity firm Forescout shows how various ICS vulnerabilities can be chained for an exploit that allows hackers to cause damage to a bridge.

Cybersecurity Funding

Internet of Things (IoT) and Industrial IoT security provider Shield-IoT this week announced that it has closed a $7.4 million Series A funding round,...


More than 1,300 ICS vulnerabilities were discovered in 2022, including nearly 1,000 that have a high or critical severity rating.