cyber.hendryadrian.com
Security News · securityweek.com

ICS Patch Tuesday: Siemens, Schneider, Mitsubishi and Moxa Address Vulnerabilities

· Original article ↗

Summary

Siemens, Schneider Electric, Mitsubishi Electric and Moxa issued ICS advisories covering flaws including code execution, DoS, XSS and hardcoded credentials; CISA and VDE-CERT also published advisories affecting industrial products.

Key points

  • Schneider Electric published six advisories covering issues including hardcoded credentials, code execution, system compromise, DoS and account takeover.
  • Siemens addressed a critical stored XSS flaw in Simatic S7-1500 devices, a potentially severe Mendix misconfiguration and vulnerabilities involving third-party components.
  • Mitsubishi Electric disclosed a remotely exploitable DoS flaw in several Numerical Control Systems product series; it had earlier reported DoS flaws in MELSEC iQ-F controllers.
  • Moxa published four advisories, three concerning vulnerabilities in Intel products; it said its products are not affected by a recent GNU Inetutils vulnerability.
  • CISA issued advisories for vulnerabilities affecting Ceragon, Lantronix and Apeman products, as well as a Honeywell building controller flaw whose impact is disputed by the vendor and researcher.
  • VDE-CERT published advisories for Codesys, Janitza and Weidmueller products; some Janitza and Weidmueller flaws could allow remote, unauthenticated attackers to compromise systems.

Article Details

Event Type
Industrial control systems Patch Tuesday vulnerability advisories and fixes
Impact
Siemens, Schneider Electric, Mitsubishi Electric, and Moxa reported vulnerabilities affecting ICS products. Issues described include hardcoded credentials, local and remote code execution, command execution, stored cross-site scripting, denial of service, account takeover, and system compromise. CISA and VDE-CERT also published advisories covering additional industrial products. The article does not provide CVE identifiers or quantify observed exploitation. Honeywell and the researcher who disclosed a building-controller vulnerability reportedly disagree about its impact.

Vendors

ApemanThe advisories inform the public about vulnerabilities in Ceragon Siklu MultiHaul and EtherHaul, Lantronix EDS3000PS and EDS5000, and Apeman cameras.CeragonThe advisories inform the public about vulnerabilities in Ceragon Siklu MultiHaul and EtherHaul, Lantronix EDS3000PS and EDS5000, and Apeman cameras.CodesysGermany’s VDE-CERT has published advisories for Codesys, Janitza, and Weidmueller product vulnerabilities.HoneywellCISA has also published an advisory for a recently disclosed Honeywell building controller vulnerability.IntelMoxa has published four new advisories, including three describing the impact of vulnerabilities discovered in Intel products.JanitzaGermany’s VDE-CERT has published advisories for Codesys, Janitza, and Weidmueller product vulnerabilities.LantronixThe advisories inform the public about vulnerabilities in Ceragon Siklu MultiHaul and EtherHaul, Lantronix EDS3000PS and EDS5000, and Apeman cameras.Mitsubishi ElectricIndustrial giants Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have published new Patch Tuesday advisories for vulnerabilities found recently in their ICS products.MoxaIndustrial giants Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have published new Patch Tuesday advisories for vulnerabilities found recently in their ICS products.Schneider ElectricIndustrial giants Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have published new Patch Tuesday advisories for vulnerabilities found recently in their ICS products.SiemensIndustrial giants Siemens, Schneider Electric, Mitsubishi Electric, and Moxa have published new Patch Tuesday advisories for vulnerabilities found recently in their ICS products.WeidmuellerGermany’s VDE-CERT has published advisories for Codesys, Janitza, and Weidmueller product vulnerabilities.

Products

Apeman camerasThe advisories inform the public about vulnerabilities in Ceragon Siklu MultiHaul and EtherHaul, Lantronix EDS3000PS and EDS5000, and Apeman cameras.Ceragon Siklu MultiHaulThe advisories inform the public about vulnerabilities in Ceragon Siklu MultiHaul and EtherHaul, Lantronix EDS3000PS and EDS5000, and Apeman cameras.CODESYSGermany’s VDE-CERT has published advisories for Codesys, Janitza, and Weidmueller product vulnerabilities.EcoStruxure Automation ExpertEcoStruxure Power Monitoring Expert and Power Operation (local arbitrary code execution), and EcoStruxure Automation Expert (command execution and full system compromise).EcoStruxure Foxboro DCSMedium-severity flaws have been patched by the company in Modicon controllers (DoS, account takeover via XSS) and EcoStruxure Foxboro DCS (remote code execution).EcoStruxure IT Data Center ExpertThe company has informed customers about high-severity issues in EcoStruxure IT Data Center Expert (hardcoded credentials), EcoStruxure Power Monitoring Expert and Power Operation (local arbitrary code execution), andEcoStruxure Power Monitoring Expertabout high-severity issues in EcoStruxure IT Data Center Expert (hardcoded credentials), EcoStruxure Power Monitoring Expert and Power Operation (local arbitrary code execution), and EcoStruxure Automation ExpertHeliox EV chargersHigh- and medium-severity issues have been patched by Siemens in the Sicam Siapp SDK, and a low-severity vulnerability has been fixed in Heliox EV chargers.Honeywell building controllerCISA has also published an advisory for a recently disclosed Honeywell building controller vulnerability.JanitzaGermany’s VDE-CERT has published advisories for Codesys, Janitza, and Weidmueller product vulnerabilities.Lantronix EDS3000PSThe advisories inform the public about vulnerabilities in Ceragon Siklu MultiHaul and EtherHaul, Lantronix EDS3000PS and EDS5000, and Apeman cameras.MELSEC iQ-F Series controllersEarlier this month the company informed customers about multiple remotely exploitable DoS flaws in MELSEC iQ-F Series controllers.Mendix applicationsSiemens has addressed a critical stored XSS vulnerability in Simatic S7-1500 devices, and a potentially severe misconfiguration in Mendix applications.Modicon controllersMedium-severity flaws have been patched by the company in Modicon controllers (DoS, account takeover via XSS) and EcoStruxure Foxboro DCS (remote code execution).Numerical Control SystemsMitsubishi Electric has published one new advisory to describe a remotely exploitable DoS vulnerability in its Numerical Control Systems, including C80, M800, M800V and M700V series products.Power OperationEcoStruxure IT Data Center Expert (hardcoded credentials), EcoStruxure Power Monitoring Expert and Power Operation (local arbitrary code execution), and EcoStruxure Automation Expert (command execution and fullSicam Siapp SDKHigh- and medium-severity issues have been patched by Siemens in the Sicam Siapp SDK, and a low-severity vulnerability has been fixed in Heliox EV chargers.Simatic S7-1500Siemens has addressed a critical stored XSS vulnerability in Simatic S7-1500 devices, and a potentially severe misconfiguration in Mendix applications.WeidmuellerGermany’s VDE-CERT has published advisories for Codesys, Janitza, and Weidmueller product vulnerabilities.

Related Articles