cyber.hendryadrian.com
Security News · securityweek.com

ICS Patch Tuesday: Siemens Issues 17 Advisories as Rockwell Fixes ArmorBlock Account-Takeover Flaw

· Original article ↗

Summary

Siemens issued 17 ICS advisories, while Rockwell, Schneider Electric, CISA and others reported vulnerabilities. A critical ArmorBlock flaw could let an unauthenticated attacker change a device’s web server password.

Key points

  • Siemens published 17 advisories, with patches for some vulnerabilities and mitigations for others.
  • Siemens advisories cover critical issues in Simatic S7-1500 CPUs, Industrial Edge devices and Ruggedcom Crossbow SAC, among other products.
  • Rockwell disclosed two vulnerabilities in 1732E ArmorBlock: a critical flaw enabling unauthenticated web server password changes that could lead to admin takeover, and a denial-of-service issue.
  • Schneider Electric disclosed a vulnerability affecting Pro-face STW6000 and Harmony STW6 that could enable device takeover after a user visits a malicious webpage, and another affecting Sage RTUs.
  • CISA issued advisories on Swann camera vulnerabilities exposing video information and privilege escalation in Inductive Automation Ignition.
  • ABB said it had no evidence of in-the-wild exploitation of a dynovaPRO credential-reset bypass, but internal logs showed 26 password-change events affecting nine customers.

Article Details

Event Type
Industrial control systems security advisories and vulnerability disclosures
Impact
Siemens issued 17 advisories, Schneider Electric issued two, and Rockwell Automation issued one. Reported impacts include device takeover and admin account takeover, malicious firmware installation, denial of service, video-information exposure, privilege escalation, and information disclosure. ABB reported 26 password-change events affecting nine customers that may indicate testing or reconnaissance related to a dynovaPRO credential-reset flaw, but said it was not aware of in-the-wild exploitation.

Vendors

ABBHitachi Energy (Asset Suite, RTU500, MicroSCADA), Johnson Controls (ADVMS, Illustra Standard, EasyIO), and ABB (Automation Builder, Mint Workbench, AC500, Protection and Control IED Manager, Freelance, and dynovaPRO).BenderGermany’s CERT@VDE has published one new advisory to inform organizations about an information disclosure vulnerability affecting Bender’s Customer&Partner platform.Inductive Automationvulnerabilities exposing video information, and the other covers a privilege escalation issue in Inductive Automation’s Ignition product.Rockwell AutomationIndustrial giants Siemens, Schneider Electric, and Rockwell Automation have published ICS security advisories this Patch Tuesday.Schneider ElectricIndustrial giants Siemens, Schneider Electric, and Rockwell Automation have published ICS security advisories this Patch Tuesday.SiemensIndustrial giants Siemens, Schneider Electric, and Rockwell Automation have published ICS security advisories this Patch Tuesday.

Products

1732E ArmorBlockIt informs customers about two vulnerabilities in 1732E ArmorBlock.Customer&Partner platformGermany’s CERT@VDE has published one new advisory to inform organizations about an information disclosure vulnerability affecting Bender’s Customer&Partner platform.dynovaPROand ABB (Automation Builder, Mint Workbench, AC500, Protection and Control IED Manager, Freelance, and dynovaPRO).Harmony STW6The first affects Pro-face STW6000 and Harmony STW6 and could allow an attacker to take control of a device by tricking the targeted user into visiting a malicious webpage.Ignitionexposing video information, and the other covers a privilege escalation issue in Inductive Automation’s Ignition product.Industrial Edge devicesThe company addressed critical vulnerabilities in some Simatic S7-1500 CPUs, Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller (SAC).Pro-face STW6000The first affects Pro-face STW6000 and Harmony STW6 and could allow an attacker to take control of a device by tricking the targeted user into visiting a malicious webpage.Ruggedcom Crossbow Station Access Controller (SAC)The company addressed critical vulnerabilities in some Simatic S7-1500 CPUs, Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller (SAC).Sage RTUsThe second affects Sage RTUs and it can be leveraged by a privileged user to install malicious firmware on a device.Simatic S7-1500 CPUsThe company addressed critical vulnerabilities in some Simatic S7-1500 CPUs, Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller (SAC).Swann SWIFI-SE2KICCISA published two new ICS advisories on Tuesday: one covers Swann SWIFI-SE2KIC camera vulnerabilities exposing video information, and the other covers a privilege escalation issue in Inductive Automation’s Ignition