ICS Advisories

Risk evaluation

Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.

Mitigatiesamenvatting

Update to V3.6.29 or later version

Risk evaluation

ABB is aware of publicly reported vulnerabilities in the product listed as affected in the advisory. Updates to the affected component that fixed the vulnerabilities are available. An attacker who successfully exploited this vulnerability could remotely execute code on the server run-ning Dokuwiki. No active exploitations of the vulnerabilities have been reported by the time of writing this document

Mitigatiesamenvatting

The vulnerabilities are not tight to any specific MES version but solely depend on the delivery including Dokuwiki, which relies on affected PHP versions. The affected PHP versions are listed in CERT-EU - Critical Vulnerabilities in PHP Reference section. The problem is corrected in the following product versions: • PHP 8.5.12 • PHP 8.4.27 • PHP 8.3.36 • PHP 8.2.35 ABB recommends that customers apply the updates immediately. The updates are applied by updating the PHP packages in operating system of the servers that run Dokuwiki. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. It needs to be checked which PHP packages are installed on the system, and upgrade them (depending on the OS, with either ‘dnf’ or ‘yum’). ABB recommends that only PHP packages are updated, not the whole Dokuwiki installation.

Risk evaluation

The monitoring functionality of affected CODESYS Control runtime systems processes read and write requests to PLC application data sent by the CODESYS Development System and other clients such as HMIs. Due to improper synchronization in the CmpMonitor2 component when processing concurrent requests from multiple clients, incorrect data may be read or written, potentially resulting in unexpected behavior of the affected product. PLCs based on the CODESYS Runtime Toolkit or CODESYS Safety SIL2 are affected if they allow simultaneous access by two or more clients via the CODESYS protocol. In CODESYS Development System 3, simultaneous access to the included Simulation Runtime can only occur when access by an external client, such as an HMI, has been explicitly enabled through dedicated configuration. The default configuration of CODESYS Development System 3 is not affected. The vulnerability can be exploited by an authenticated remote attacker with monitoring access by issuing concurrent requests to an affected product.

Mitigatiesamenvatting

Update the following products to version 3.5.22.40. * CODESYS Control RTE (SL) * CODESYS Control RTE (for Beckhoff CX) SL * CODESYS Control Win (SL) * CODESYS Runtime Toolkit * CODESYS Safety SIL2 * CODESYS HMI (SL) * CODESYS Development System 3 The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk evaluation

The CODESYS Gateway Client (CmpGwClient) is used by various CODESYS products to establish PLC communication via the CODESYS Gateway. Due to missing limits on memory allocations derived from a size field in a gateway response, a malicious gateway can cause excessive memory consumption in the client, resulting in a denial-of-service condition. The vulnerability can be exploited when an affected product connects to an attacker-controlled gateway.

Mitigatiesamenvatting

Update the following products to version 3.5.22.40. * CODESYS Development System 3 * CODESYS Gateway * CODESYS Edge Gateway for Windows * CODESYS HMI (SL) * CODESYS OPC DA Server SL * CODESYS PLCHandler * CODESYS Runtime Toolkit The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk evaluation

ABB identified a critical vulnerability present in ABB Ability Edgenius versions 3.2.3.0 and below. We have not received any reports of this vulnerability being exploited. This issue may allow unauthorized manipulation of the edge authentication database if successfully exploited. ABB has developed and released a corrective update that resolves this vulnerability and enhances the security posture of the affected system.

Mitigatiesamenvatting

Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove exposure with well-known impact on functionality. For brownfield customers, ABB provides a Kubernetes network policy that restricts access to Edge Authentication Database (AuthDB) to the authorized services required for normal operation of an already deployed and configured system. For implementation details, refer to Technical Description-ABB Ability Edgenius Missing Authentication in Edgenius AuthDB.docx (7PAA025722) listed in the reference section, distributed separately.

Risk evaluation

Festo AX OS versions 25.0.1.46 and 25.9.2.4, which are based on PLCnext by Phoenix Contact, used by the Festo product CEPE are affected by multiple OpenSSL vulnerabilities. The vulnerabilities are identified as CVE-2025-15467 and CVE-2025-69419. Attacks may be possible when maliciously crafted firmware, key files, PKCS#12 files, CMS/PKCS#7 content, or digitally signed objects are uploaded and processed by the affected system. In the device context, exploitation typically requires a logged-in user with high privileges or the processing of attacker-supplied cryptographic objects.

Mitigatiesamenvatting

Update affected CEPE installations running Festo AX OS 25.0.1.46 or Festo AX OS 25.9.2.4 to Festo AX OS 26.3.1.4 or later.

Risk evaluation

The 'piControl' kernel module used in the IndustrialPI, prior to version 2.8.0-1, contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can lead to kernel memory corruption and denial of service.

Mitigatiesamenvatting

Update package 'picontrol' to version 2.8.0-1 or higher.

Risk evaluation

The 'Pictory' web config tool, prior to 2.17.0, has a Cross-Site Request Forgery (CSRF) vulnerability, which makes it vulnerable to session takeover. The 'revpipyload' package, prior to version 0.11.1, has a vulnerability in the file management functionality of its XML-RPC interface. This allows an attacker to access or delete arbitrary files that the 'revpipyload' process has access to.

Mitigatiesamenvatting

Update the 'pictory' package to version 2.17.0 or higher

Risk evaluation

The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Siemens has released a new version for Siemens Software Center and recommends to update to the latest version. Please refer to our blog post for additional information about current known active exploitation and how to detect it.

Mitigatiesamenvatting

Update to V4.0.9.8 or later version (All existing versions of SSC will be auto updated on next startup. The latest version can also be downloaded in the respective link)

Risk evaluation

SICK CorivaHub includes the third-party components Apache Tomcat and MapLibre GL, which are affected by two known vulnerabilities. These vulnerabilities include an improper input validation issue in Apache Tomcat and a vulnerability in MapLibre GL that could allow malicious behavior through custom GUIs. Under certain conditions, successful exploitation could affect the confidentiality, integrity and availability of the affected system. The attack surface associated with the Apache Tomcat vulnerability is significantly reduced by the default product configuration. Nevertheless, SICK recommends updating to CorivaHub 2026.1.2 to remediate both vulnerabilities.

Mitigatiesamenvatting

Users are recommended to upgrade to version 2026.1.2.

Risk evaluation

An out-of-bounds read vulnerability exists in the open-source repository sick_safetyscanners_base (https://github.com/SICKAG/sick_safetyscanners_base), a standalone C++ driver library for SICK safety laser scanners. A specially crafted network packet could cause the library to read data beyond the bounds of the received buffer. If exploited, this vulnerability could potentially affect the availability of applications using the affected library. SICK recommends applying the defined remediations for this vulnerability.

Mitigatiesamenvatting

Users are recommended to upgrade to version 1.0.5.

Risk evaluation

An update is available that resolves a privately reported vulnerability to the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the node running the product to stop or to become inaccessible.

Mitigatiesamenvatting

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. Refer to section General security recommendations for further advice on how to keep your system secure. For the reported issue there are no known mitigating factors.

Risk evaluation

Multiple vulnerabilities in the third-party component fast-xml-parser affect the Device Manager Extension in Sentio Creator. The extension is maintained and updated independently from SICK Sentio Creator, but successful exploitation of these vulnerabilities could impact the security of the Sentio Creator. SICK strongly recommends upgrading the extension to remediate the identified issues.

Mitigatiesamenvatting

It is strongly recommended to upgrade the Device Manger Extension to version 1.1.1.

Risk evaluation

Bender is publishing this advisory to inform customers about a security vulnerability in the Customer&Partner platform. The issue allows any account to view the roles of other users. Bender has analyzed the weakness and determined that user information and user credentials are not affected. Bender considers the weakness to be of medium risk which should be patched.

Mitigatiesamenvatting

Bender service updated to version 5.17.5 or later. The fix is planned in Q4 2026.

Risk evaluation

Schneider Electric is aware of a vulnerability in its [ATVdPAC module](http://www.se.com/ww/en/product/VW3A3530D/atv-dpac-module/) / [ATV6000 Medium Voltage Altivar Process Drives](http://www.se.com/ww/en/product-range/65607-altivar-process-atv6000) / [ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives](http://www.se.com/ww/en/product-range/62317-altivar-process-atv600) / [ATV930/950/955/960/980/9A0/9B0/9L0 Altivar Process Drives](http://www.se.com/ww/en/product-range/63124-altivar-process-atv900) / [ATV340E Altivar Machine Drives](http://www.se.com/ww/en/product-range/63441-altivar-machine-atv340#products) /[ATS490 Altivar Soft Starter](http://www.se.com/ww/en/product-range/213421154-altivar-soft-starter-ats490) / [Altivar Process Communication Modules](http://www.se.com/ww/en/product-range/62317-altivar-process-atv600/117623851529-modular-drives-apm) product(s). Failure to apply remediation mitigations provided below may risk Cross-Site Scripting, which could result in partial loss of confidentiality and integrity of the workstation running a Web browser.

Mitigatiesamenvatting

Version 25.0 of VW3A3530D: ATVdPAC module includes a fix for this vulnerability and is available upon request from Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp).

Risk evaluation

Schneider Electric is aware of multiple vulnerabilities in its Pro-face STW6000 and Harmony STW6 products. The Pro-face STW6000 and Harmony STW6 products are Basic Web HMI panels belongs to the Schneider Electric Harmony ST6 and Pro-face ST6000 range and is designed to meet the needs of simple machine operators for good visualization, connectivity, and cost-effective equipment. Failure to apply the mitigations provided below may risk various attack scenarios due to Third-party component obsolescence, which could result in unauthorized control to the device and operational failures.

Mitigatiesamenvatting

Customers should immediately apply the following mitigations to reduce the risk of exploit: • Use HMI only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. • Configure the trusted local websites for connecting and browsing in the HMI device. • Setup network segmentation and implement a firewall to block all unauthorized access. • Restrict usage of unverifiable portable media • Configuration must be done by a trusted administrator and authenticated users To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

Risk evaluation

Schneider Electric is aware of a vulnerability in its SAGE RTU products. The SAGE RTU products are a line of devices designed for substation data acquisition and control. Failure to apply the mitigations provided below may enable a privileged user to install maliciously modified firmware on a SAGE RTU during an upgrade operation, resulting in modified device behavior.

Mitigatiesamenvatting

Version C3414-500-S02L0 of SAGE RTU includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/C3414-500-S02L0_Firmware/ • Reboot needed: Yes After upgrading, navigate to the CPU configuration page to verify the firmware version number is correct.

Risk evaluation

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V3.1.6 only; for version V3.1.7 refer to SSA-457936.

Mitigatiesamenvatting

Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.

Risk evaluation

The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends updating to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Mitigatiesamenvatting

Apply network segmentation and put the ECUs behind properly configured gateways/firewalls

Risk evaluation

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113.

Mitigatiesamenvatting

Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.

Risk evaluation

SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-established to restore normal operation.

Mitigatiesamenvatting

Update to V5.2 or later version

Risk evaluation

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/

Mitigatiesamenvatting

Contact customer support to receive patch and update information

Risk evaluation

Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigation measures.

Mitigatiesamenvatting

Update Fortigate NGFW to V7.6.7 or later following the secure update recommendation procedure. Contact customer support to receive detailed information

Risk evaluation

PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.

Mitigatiesamenvatting

Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from <a href="https://www.wibu.com/support/user/user-software.html">User Software - Wibu-Systems</a> and follow the installation instructions from WIBU Systems.

Risk evaluation

The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled. Siemens has released new versions for the affected products and recommends to update to the latest versions.

Mitigatiesamenvatting

<br/>Note: After upgrading to the fixed BIOS version, users must load the BIOS default settings. If Secure Boot keys were already provisioned, they must be provisioned again afterwards.