ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Aveva, Phoenix Contact

Siemens, Schneider Electric, Aveva and Phoenix Contact issued around a dozen Patch Tuesday advisories detailing vulnerabilities in their ICS/OT products, SecurityWeek reports.

Siemens released five new advisories, including two describing the same critical authorization bypass flaw in Industrial Edge Devices that an unauthenticated remote attacker could use to bypass authentication and impersonate a user, with one advisory covering Industrial Edge Devices and the other the Industrial Edge Device Kit, plus fixes for high‑severity issues in Ruggedcom, ET 200SP and TeleControl Server Basic products.

Schneider Electric published four advisories, one of which covers a high‑severity privilege escalation in EcoStruxure Process products, while another notes a medium‑ and a high‑severity flaw in EcoStruxure Power Build Rapsody that can enable arbitrary code execution via specially crafted files; other advisories describe issues in third‑party components Zigbee and Redis.

Phoenix Contact issued an advisory on a high‑severity command injection in TC Router and Cloud Client industrial routers, achievable if an attacker has elevated privileges or can trick a user into uploading a malicious payload, and Germany’s VDE CERT published a version of this advisory. Aveva detailed seven vulnerability types in Process Optimization (formerly ROMeo) that are high or critical severity and can enable remote code execution, privilege escalation and data access.

According to CISA, ICS advisories were also published for Rockwell Automation vulnerabilities disclosed in December 2025 and for three flaws in the YoSmart YoLink Smart Hub.