Industrial giants Schneider Electric and Siemens have released their February 2025 Patch Tuesday ICS security advisories.
Siemens has published 14 new advisories covering a total of approximately 100 vulnerabilities. This includes roughly 70 third-party component issues addressed in Scalance W devices.
Siemens has released patches for some of the impacted products and it’s working on releasing additional fixes.
Based on their CVSS score, the most important vulnerabilities affect the Tableau Server component of Opcenter Intelligence. Two critical flaws could allow remote code/command execution. In addition, high-severity vulnerabilities found in the product can allow malicious admins to change user passwords, and conduct SSRF attacks.
Ten high- and medium-severity vulnerabilities will be patched by Siemens in Ruggedcom APE1808 appliances that use Fortinet firewall technology. Fortinet’s FortiOS patches will soon be available for impacted Siemens devices.
Siemens has also addressed high-severity issues in Siprotec 5 (information disclosure, arbitrary command execution), Apogee PXC and Talon TC (password decryption), Simatic and Sirius (session token reuse), Simatic S7-1200 (DoS), Simatic IPC (privilege escalation), and Teamcenter (open redirect).
Save the date: 2025 ICS Cyber Security Conference – October 27-30, Atlanta
Schneider Electric has published four new advisories covering a total of nine vulnerabilities.
One of the advisories informs customers about four high-severity flaws in ASCO Remote Annunciator products. The security holes could be exploited to cause disruption and to obtain sensitive information.
Schneider also informed customers about one high-severity vulnerability in EcoStruxure products. The flaw can lead to privilege escalation.
The remaining advisories describe medium-severity issues that could be exploited for DoS attacks against EcoStruxure and Enerlin products.
Related: ICS Patch Tuesday: Security Advisories Published by Schneider, Siemens, Phoenix Contact, CISA
Related: ICS Patch Tuesday: Security Advisories Released by Siemens, Schneider, CISA, Others
