cyber.hendryadrian.com
Security News · securityweek.com

Siemens, Schneider Electric and Phoenix Contact Patch ICS Vulnerabilities

· Original article ↗

Summary

Siemens, Schneider Electric and Phoenix Contact issued August 2026 ICS advisories covering flaws that could enable unauthenticated code execution, command execution, denial of service and other impacts across their products.

Key points

  • Siemens published 10 advisories, including a maximum-severity missing-authentication flaw in Simatic IoT2050 Advanced devices that could let a remote unauthenticated attacker execute arbitrary code with elevated privileges.
  • Siemens also fixed a critical code-execution vulnerability in Siveillance Video Management Servers and addressed other flaws across several products.
  • Schneider Electric fixed code- and command-execution issues in NetBotz 5 and a PowerChute Serial Shutdown flaw involving excessive authentication attempts.
  • Phoenix Contact reported multiple PLCnext firmware vulnerabilities that could enable denial of service, unexpected behavior or malicious SQL queries.
  • Honeywell issued several advisories for building management products; CISA also published advisories covering Pulsetto, Mira and Johnson Controls products.

Article Details

Event Type
Industrial control system vulnerability advisories and patches
Impact
Siemens, Schneider Electric, and Phoenix Contact published advisories addressing vulnerabilities in their products. Reported impacts include unauthenticated remote code execution with elevated privileges in Simatic IoT2050 Advanced devices; code execution in Siveillance Video Management Servers and NetBotz 5; and potential application crashes, privilege escalation, arbitrary file access, sensitive-information exposure, disruption, unexpected behavior, and malicious SQL query execution across other affected products. The article does not report active exploitation.

Vendors

HoneywellHoneywell has published several advisories for its building management system products.Johnson ControlsThe new advisories cover vulnerabilities in Pulsetto, Mira (Quanovate Tech), and Johnson Controls products.Phoenix ContactIndustrial giants Siemens, Schneider Electric, and Phoenix Contact have published August 2026 Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS products.Quanovate TechThe new advisories cover vulnerabilities in Pulsetto, Mira (Quanovate Tech), and Johnson Controls products.Schneider ElectricIndustrial giants Siemens, Schneider Electric, and Phoenix Contact have published August 2026 Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS products.SiemensIndustrial giants Siemens, Schneider Electric, and Phoenix Contact have published August 2026 Patch Tuesday advisories to inform customers about vulnerabilities found in their ICS products.

Products

DesigoMedium-severity issues have been resolved in Ruggedcom devices and Desigo controllers.MiraThe new advisories cover vulnerabilities in Pulsetto, Mira (Quanovate Tech), and Johnson Controls products.NetBotz 5Schneider Electric has published two new advisories describing vulnerabilities in NetBotz 5 and PowerChute Serial Shutdown products.ParasolidHigh-severity flaws have been addressed in Solid Edge, Simcenter Nastran, Siemens License Server, Simcenter Femap, Parasolid, and Logo!PLCnext firmwarePhoenix Contact has published one advisory for multiple vulnerabilities in PLCnext firmware.PowerChute Serial ShutdownSchneider Electric has published two new advisories describing vulnerabilities in NetBotz 5 and PowerChute Serial Shutdown products.PulsettoThe new advisories cover vulnerabilities in Pulsetto, Mira (Quanovate Tech), and Johnson Controls products.RuggedcomMedium-severity issues have been resolved in Ruggedcom devices and Desigo controllers.Siemens License ServerHigh-severity flaws have been addressed in Solid Edge, Simcenter Nastran, Siemens License Server, Simcenter Femap, Parasolid, and Logo!Simatic IoT2050 AdvancedOne covers a maximum-severity missing-authentication vulnerability in Simatic IoT2050 Advanced devices.Simcenter FemapHigh-severity flaws have been addressed in Solid Edge, Simcenter Nastran, Siemens License Server, Simcenter Femap, Parasolid, and Logo!Simcenter NastranHigh-severity flaws have been addressed in Solid Edge, Simcenter Nastran, Siemens License Server, Simcenter Femap, Parasolid, and Logo!Siveillance Video Management ServersA critical code execution vulnerability has also been fixed by Siemens in the Siveillance Video Management Servers.Solid EdgeHigh-severity flaws have been addressed in Solid Edge, Simcenter Nastran, Siemens License Server, Simcenter Femap, Parasolid, and Logo!