For awareness Low Monitor
Siemens and other vendors publish pre-Patch Tuesday industrial advisories
SecurityWeek ICS/OTSiemens, VDE CERT, Phoenix Contact
What happened. SecurityWeek reports that VDE CERT, Phoenix Contact, Johnson Controls and Hitachi Energy published advisories ahead of Patch Tuesday. Its headline says Siemens flagged high-severity flaws and names Node2Shell exposure.
Who is affected. Users of products from Siemens, Phoenix Contact, Johnson Controls and Hitachi Energy. The report does not list products or versions.
What to do. Check the Siemens, Phoenix Contact, Johnson Controls and Hitachi Energy advisories against your asset list and apply the fixes that match your equipment.
When to act. For awareness: ICS owners: check the named vendors' advisories for products you run; no action is due from this roundup alone.
Editor's reading
Forasset ownerOT security lead
- Are you exposed?
Compare the vendors' advisories with your asset inventory for matching products and versions.
- If you cannot fix it yet
- Restrict network access to affected devices to known engineering hosts until you have checked the advisories.
- Watch for
- Unexpected connections to devices from the vendors named, coming from the IT network.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: SecurityWeek ICS/OT (opens securityweek.com)
More on Siemens Phoenix Contact