Industrial giants Siemens and Schneider Electric have published their Patch Tuesday advisories for April 2024, informing customers about the vulnerabilities found in their ICS products over the past month.
Siemens published eight new advisories covering a total of roughly 80 vulnerabilities. One advisory covers nearly 50 flaws found in the company’s Telecontrol Server Basic product, particularly in third-party components.
The company also announced patches for three critical arbitrary code execution vulnerabilities in Scalance W1750D access points, which are rebranded Aruba devices.
Two advisories cover vulnerabilities introduced by the use of Palo Alto Networks virtual next-generation firewalls. The flaws impact Siemens’ Ruggedcom APE1808 industrial application hosting platform, which enables organizations to deploy commercially available applications for edge computing and cybersecurity in harsh environments.
One of these advisories focuses on an attack named Terrapin, which allows an attacker who can intercept SSH traffic on Palo Alto Networks products to downgrade connection security.
The second advisory covers six vulnerabilities discovered in Palo Alto Networks’ PAN-OS software in 2022 and 2023, including a flaw that was exploited for DDoS attacks in 2022.
Ruggedcom APE1808 also uses technology from Fortinet and Nozomi Networks, and Siemens previously informed customers about vulnerabilities in the products of these vendors.
Siemens has also informed customers about vulnerabilities in Simatic S7-100 (Linux component issues), Sinec NMS, Parasolid, and Simatic WinCC products.
The company has started releasing patches for these vulnerabilities, but only mitigations are currently available for some of them.
It’s worth noting that while Siemens typically addresses a higher number of vulnerabilities each month compared to other vendors, this is an indication of the effort the company puts into securing its products rather than evidence that its products are more vulnerable.
Schneider Electric has published one new advisory this month, informing customers of a high-severity privilege escalation vulnerability affecting its Easergy Studio product.
Related: UK Government Releases Cloud SCADA Security Guidance
Related: 1 in 4 Organizations Shut Down OT Operations Due to Cyberattacks: Survey
