[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frFaV_wD181f7KqWHWBFBWn9ZiqDO4bLH33mBgR29_1U":3},{"article":4,"iocs":48,"watch_terms":56,"solutions":57,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"8a564ca1-cff5-4b2c-9854-ed7460a52dcb","ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure","ics-patch-tuesday-siemens-flags-high-severity-flaws-node2shell-exposure-4c8dd5","Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. The post ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure appeared first on SecurityWeek.","Siemens has released nine advisories detailing 10 vulnerabilities, including two related to Node2Shell, in various industrial control systems. Other vendors like Schneider Electric, Johnson Controls, and Hitachi Energy have also published advisories for medium and high-severity flaws. These vulnerabilities can lead to code injection, arbitrary code execution, unauthorized data access, and system compromise. Patches are not available for all affected products, and customers are advised to implement mitigations.","Siemens, Schneider Electric, and other ICS vendors release advisories for multiple vulnerabilities.","https:\u002F\u002Fwww.securityweek.com\u002Fics-patch-tuesday-siemens-flags-high-severity-flaws-node2shell-exposure\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F11\u002FICS_Patches.jpg","2026-11-11T10:35:15+00:00","2026-11-11T11:00:27.806638+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Siemens","vendor",{"name":21,"type":19},"Schneider Electric",{"name":23,"type":19},"Johnson Controls",{"name":25,"type":19},"Hitachi Energy",{"name":27,"type":19},"Phoenix Contact",{"name":29,"type":19},"Beckhoff","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53],{"type":50,"value":51,"context":52},"malware","Node2Shell","Vulnerability affecting Siemens products.",{"type":50,"value":54,"context":55},"PHP2Shell","Vulnerability affecting third-party components used by multiple ICS vendors.",[18,21,23],{"controls":58,"vendors":142},[59,88,113],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,97,105],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":89,"product_name":94,"url":95,"description":96},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":114,"name":115,"problem":116,"products":117},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",[143,149],{"slug":144,"name":145,"logo_path":146,"roles":147},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[148],"affected",{"slug":150,"name":18,"logo_path":151,"roles":152},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[148],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":163},"ics-vendors-release-patches-for-high-severity-flaws-not-all-products-covered","ICS Vendors Release Patches for High-Severity Flaws — Not All Products Covered","Siemens, Schneider Electric, Johnson Controls, and Hitachi Energy have disclosed multiple high-severity vulnerabilities across industrial control systems, including flaws in Node2Shell that could enable code injection, arbitrary code execution, and unauthorized data access. Critically, patches are not yet available for all affected products, leaving operators exposed with only workarounds as a defense. ICS environments are particularly high-risk targets because downtime and legacy constraints often delay patching, extending exposure windows. This incident underscores that vulnerability management in OT\u002FICS settings must go beyond patching — requiring compensating controls, network segmentation, and continuous monitoring when patches cannot be immediately applied.",[158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIST CSF 2.0 ID.RA-1: Asset vulnerabilities are identified and documented",{"NIS2 Article 21(2)(e)":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"CIS Control 7: Continuous Vulnerability Management (v8)":166,"CIS Control 2: Inventory and Control of Software Assets (v8)":167,"NIST CSF 2.0 ID.RA-1: Asset vulnerabilities are identified and documented":168},"This point specifically covers vulnerability handling and disclosure in the security of network and information systems, which is the core issue when ICS vendors release advisories without full patch coverage for all affected products.","SI-2 requires organizations to identify, report, and correct information system flaws — the absence of patches for all affected products means compensating controls mandated by this control must be enacted promptly.","This control requires organizations to continuously assess and remediate vulnerabilities — directly applicable here where multiple high-severity ICS flaws were disclosed and patches were not universally available, requiring prioritized mitigation.","Knowing exactly which software versions are deployed across ICS environments is a prerequisite for determining exposure to the disclosed Node2Shell and related vulnerabilities.","Identifying which specific ICS assets are exposed to the disclosed vulnerabilities is the foundational step needed before any mitigation or patching action can be taken in this incident."]