Siemens and Schneider Electric have addressed more than 100 vulnerabilities with their March 2023 Patch Tuesday security advisories.
Siemens
Siemens has released only seven new advisories, but they describe a total of 92 vulnerabilities. However, a vast majority are introduced by the use of third-party components rather than being specific to Siemens products.
For instance, 65 vulnerabilities affecting components such as the Linux kernel, Busybox, OpenSSL and OpenVPN have been patched in Ruggedcom and Scalance products. Exploitation of these flaws can lead to a denial of service (DoS) condition or to code injection.
Seventeen vulnerabilities affecting third-party components have been patched in Scalance devices. Exploitation of these security holes can lead to a DoS condition or the disclosure of sensitive data.
Siemens has also announced that several OpenSSL vulnerabilities have been addressed in Scalance W1750D devices.
A high-severity DoS vulnerability affecting Wind River VxWorks has been patched in Siprotec 5 devices.
[ Read: Counting ICS Vulnerabilities: Examining Variations in Numbers Reported by Security Firms ]
In addition to vulnerabilities affecting third-party components, Siemens has informed customers about a critical authentication bypass issue affecting the Mendix SAML module.
The company has also disclosed privilege escalation, information disclosure, and SQL injection bugs in Ruggedcom Crossbow devices, including high-severity issues.
It’s worth noting that Siemens has yet to release actual patches for some of these vulnerabilities. In some cases, only mitigations are currently available.
Schneider Electric
Schneider Electric has published three new advisories covering a total of 10 vulnerabilities.
One advisory describes a critical vulnerability in PowerLogic power meters. The flaw can be exploited for DoS attacks or remote code execution.
Another advisory describes eight security holes found in the IGSS SCADA product. Various modules of IGSS are affected by DoS and remote code execution issues that have been assigned ‘high’ and ‘medium’ severity ratings.
The last advisory informs users about a session hijacking issue affecting the EcoStruxure Power Monitoring Expert product.
Siemens and Schneider on Tuesday also updated dozens of previous advisories to inform customers about the availability of patches, new CVEs, changes in affected product lists, and other information.
Related: Siemens Drives Rise in ICS Vulnerabilities Discovered in 2022
Related: ICS Patch Tuesday: 100 Vulnerabilities Addressed by Siemens, Schneider Electric
Related: 2023 ICS Patch Tuesday Debuts With 12 Security Advisories From Siemens, Schneider
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Thousands Access Fake DDoS-for-Hire Websites Set Up by UK Police
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
Latest News
- 14 Million Records Stolen in Data Breach at Latitude Financial Services
- Webinar Today: Understanding Hidden Third-Party Identity Access Risks
- Thousands Access Fake DDoS-for-Hire Websites Set Up by UK Police
- iOS Security Update Patches Exploited Vulnerability in Older iPhones
- Microsoft: No-Interaction Outlook Zero Day Exploited Since Last April
- US to Adopt New Restrictions on Using Commercial Spyware
- Hackers Earn Over $1 Million at Pwn2Own Exploit Contest
- GoAnywhere Zero-Day Attack Hits Major Orgs
