ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

What it is

SecurityWeek's roundup of the ICS advisories published this Patch Tuesday, plus those issued since the previous one. The page gives no CVE IDs, CVSS scores or fixed versions, so use it to check which of your vendors and products have new advisories, then pull the vendor advisory for the details.

Affected

Siemens (17 advisories). Some have patches, others only mitigations until permanent fixes ship.

• Critical: certain Simatic S7-1500 CPUs (400+ flaws in the GNU/Linux subsystem), Industrial Edge devices, Ruggedcom Crossbow SAC.
• High: Ruggedcom Crossbow, Simatic IPC, PSS(R)SINCAL, .NET Client Library for Simatic S7 Webserver API, Industrial Edge App Publisher, Apogee, Desigo, Talon, Ruggedcom APE1808, Simatic WinCC.
• Medium: Sentron 3NA COM Fuse, Capital Embedded AR Classic.
• Also a documentation ambiguity affecting Simatic S7 PLCs and related products.

Schneider Electric (two high-severity advisories).

• Pro-face STW6000 / Harmony STW6: device takeover by tricking a user into visiting a malicious webpage.
• Sage RTUs: a privileged user can install malicious firmware.

Rockwell 1732E ArmorBlock. The critical flaw lets an unauthenticated attacker change the web server password, leading to admin takeover. A second flaw is a DoS.

CISA.

• Swann SWIFI-SE2KIC cameras: exposure of video information.
• Inductive Automation Ignition: privilege escalation.

CERT@VDE. Information disclosure in Bender's Customer&Partner platform.

Since the last Patch Tuesday.

• Moxa: two severe protocol gateway flaws.
• Honeywell: Pro-Watch.
• Hitachi Energy: Asset Suite, RTU500, MicroSCADA.
• Johnson Controls: ADVMS, Illustra Standard, EasyIO.
• ABB: Automation Builder, Mint Workbench, AC500, Protection and Control IED Manager, Freelance, dynovaPRO.

What to do

• Check your asset inventory against the lists above. Prioritize anything internet- or IT-network-reachable, especially ArmorBlock web servers, since that bug needs no authentication.
• For Siemens items with only mitigations, apply them now and track for the permanent fix.
• If you run ABB dynovaPRO, review your own password-change and reset logs. ABB's internal logs showed 26 password change events across 9 customers, which it says "may indicate testing or reconnaissance activity".
• The page recommends monitoring CISA and CERT@VDE for ICS advisories.

Caveats

• ABB says it is not aware of in-the-wild exploitation of dynovaPRO.
• The page gives no patch versions or workarounds, and does not say which Siemens items are patched versus mitigated only.