ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Rockwell, Schneider

ICS Patch Tuesday highlights: Siemens, Schneider Electric, and Rockwell Automation have issued patch advisories for their ICS/OT products, with Siemens publishing 14 new advisories and three deemed critical covering Comos, Sicam T, and Ruggedcom ROX components. According to SecurityWeek, Siemens also assigned high and medium severities across several products, noting risks such as arbitrary code execution, DoS, unauthorized access, MitM attacks and information exposure.

Schneider Electric published two advisories, one addressing an exploited WSUS vulnerability in EcoStruxure Foxboro DCS and the other detailing the ZombieLoad impact on the same product. Rockwell Automation released two advisories, including a high‑severity DoS on the 432ES‑IG3 Series A GuardLink EtherNet/IP interface and a high‑severity SQL injection in FactoryTalk DataMosaix Private Cloud.

Phoenix Contact contributed one advisory describing multiple XSS, DoS, authentication and information exposure vulnerabilities in FL SWITCH 2xxx switches, a point also noted by Germany’s VDE CERT. Additionally, according to CISA, three new advisories describe vulnerabilities affecting CCTV cameras in India, Festo LX Appliance XSS and U‑Boot code execution.