ICS Patch Tuesday: Vulnerabilities Addressed by Schneider Electric, Siemens

Industrial giants Schneider Electric and Siemens have released their February 2025 Patch Tuesday ICS security advisories.

Siemens has published 14 new advisories covering a total of approximately 100 vulnerabilities. This includes roughly 70 third-party component issues addressed in Scalance W devices.

Siemens has released patches for some of the impacted products and it’s working on releasing additional fixes.

Based on their CVSS score, the most important vulnerabilities affect the Tableau Server component of Opcenter Intelligence. Two critical flaws could allow remote code/command execution. In addition, high-severity vulnerabilities found in the product can allow malicious admins to change user passwords, and conduct SSRF attacks.

Ten high- and medium-severity vulnerabilities will be patched by Siemens in Ruggedcom APE1808 appliances that use Fortinet firewall technology. Fortinet’s FortiOS patches will soon be available for impacted Siemens devices.

Siemens has also addressed high-severity issues in Siprotec 5 (information disclosure, arbitrary command execution), Apogee PXC and Talon TC (password decryption), Simatic and Sirius (session token reuse), Simatic S7-1200 (DoS), Simatic IPC (privilege escalation), and Teamcenter (open redirect).

Schneider Electric has published four new advisories covering a total of nine vulnerabilities.

Source:

https://www.securityweek.com/ics-patch-tuesday-vulnerabilities-addressed-by-schneider-electric-siemens/

‍

‍

‍

‍