ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
Siemens, Rockwell, and Schneider Electric issue ICS security advisories with numerous vulnerabilities.
Run Siemens?
Get an email when a reviewed story names Siemens, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Industrial giants Siemens, Schneider Electric, and Rockwell Automation have released numerous ICS security advisories, with Siemens issuing 17 new advisories. These address critical and high-severity vulnerabilities in products like Simatic S7-1500 CPUs, Industrial Edge devices, and ArmorBlock, with some requiring mitigations until permanent fixes are available. Other vendors like CISA, CERT@VDE, Moxa, Honeywell, Hitachi Energy, Johnson Controls, and ABB also published advisories covering a range of industrial control system products.
The lesson from this incident
Full lessonMultiple industrial control system vendors — including Siemens, Schneider Electric, and Rockwell Automation — have disclosed numerous critical and high-severity vulnerabilities affecting widely deployed OT/ICS products such as Simatic S7-1500 CPUs and ArmorBlock devices. Some vulnerabilities allow full device takeover, meaning an attacker could disrupt or manipulate physical industrial processes with potentially catastrophic consequences. The fact that permanent fixes are not yet available for some issues highlights the persistent challenge of patch lifecycle management in operational technology environments, where uptime requirements often delay remediation. This matters because ICS systems underpin critical infrastructure including energy, manufacturing, and water treatment, making them high-value targets for nation-state actors and ransomware groups alike.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.