Siemens publishes 17 ICS advisories with critical flaws in S7-1500 CPUs and Crossbow SAC
Siemens published 17 ICS advisories on Patch Tuesday, with critical flaws in Simatic S7-1500 CPUs, Industrial Edge and Ruggedcom Crossbow SAC. Some are patched; for others Siemens has issued only mitigations.
The Watch · Security desk
What happened
- Rockwell's single advisory covers two 1732E ArmorBlock bugs; the critical one lets an unauthenticated attacker change the web server password and take over the admin account.
- Schneider Electric issued two high-severity advisories, one letting a lured user's visit to a malicious webpage hand over a Pro-face or Harmony device, the other letting a privileged user install firmware on Sage RTUs.
- ABB's dynovaPRO advisory, issued earlier in the cycle, covers account takeover through a credential reset bypass, and ABB says it knows of no in-the-wild exploitation.
Why it matters
- exposure Any 1732E ArmorBlock whose web server an attacker can reach is open to admin takeover without credentials, so network placement sets the urgency.
- constraint Where Siemens has shipped only mitigations, patching cannot close the hole, and the interim control has to stay in place until a permanent fix arrives.
- decision The Schneider Pro-face and Sage RTU flaws need a lured user or a privileged account, so they can queue behind the Rockwell and Siemens critical items.
Order the work by what an attacker needs. Rockwell's critical ArmorBlock flaw needs the least. An unauthenticated attacker can change the device's web server password, and that leads to admin account takeover [9]. No credentials and no lured user are involved, so exposure comes down to whether that web server is reachable from an untrusted network.
Siemens is the larger queue. The critical flaws are in the Ruggedcom Crossbow Station Access Controller, Industrial Edge devices and a subset of Simatic S7-1500 CPUs [3]. Siemens has patches for some of its vulnerabilities and mitigations for others until permanent fixes are available [2]. For the Simatic CPUs, more than 400 flaws affect the GNU/Linux subsystem [4]. A count that size points to a bundled operating system layer, and ranking within it needs the advisory text for each CPU.
Schneider Electric's two advisories each cover one high-severity bug, and both carry a precondition. The Pro-face STW6000 and Harmony STW6 flaw hands an attacker control of the device if the targeted user can be lured to a malicious webpage [6]. The Sage RTU flaw can be used by a privileged user to install malicious firmware [7]. Both are real, and both sit behind a lured user or an existing privileged account.
One item has evidence of activity. ABB's dynovaPRO advisory was published between the previous Patch Tuesday and this one, and it covers account takeover through a bypass in the credential reset flow [11]. ABB said it is not aware of any in-the-wild exploitation [12]. It also said: "Internal log analysis identified 26 password change events affecting 9 customers, which may indicate testing or reconnaissance activity." [13]
Across Siemens, Schneider Electric and Rockwell that is 20 new vendor advisories [16]. CISA added two, covering Swann SWIFI-SE2KIC cameras and Inductive Automation's Ignition [14], and CERT@VDE added one for Bender's Customer&Partner platform [15]. SecurityWeek's report does not include CVE identifiers, severity scores or exploitation status for the Siemens, Schneider and Rockwell items, and it attributes none of them to an actor or campaign. On this evidence it is one release cycle, and the ABB log entries are the only sign of anyone probing.
What to watch
- Siemens permanent fixes for the products that currently have only mitigations.
- CVE identifiers, scores or exploitation status for the Rockwell ArmorBlock web server password flaw.
- Any ABB follow-up on the 26 dynovaPRO password change events across 9 customers.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Siemens published 17 new advisories this Patch Tuesday.
- [2]
Siemens released patches for some of the vulnerabilities and shared mitigations for others until permanent fixes become available.
- [3]
Siemens addressed critical vulnerabilities in some Simatic S7-1500 CPUs, Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller (SAC).
- [4]
For Simatic CPUs, more than 400 flaws affect the GNU/Linux subsystem.
- [5]
Schneider Electric released two new advisories, each covering one high-severity vulnerability.
- [6]
The Schneider Electric flaw affecting Pro-face STW6000 and Harmony STW6 could allow an attacker to take control of a device by tricking the targeted user into visiting a malicious webpage.
- [7]
The Schneider Electric flaw affecting Sage RTUs can be leveraged by a privileged user to install malicious firmware on a device.
- [8]
Rockwell Automation published one new advisory on Tuesday, informing customers about two vulnerabilities in 1732E ArmorBlock.
- [9]
One of the two 1732E ArmorBlock vulnerabilities, rated critical, allows an unauthenticated attacker to change a device's web server password, which can lead to admin account takeover.
- [10]
The second 1732E ArmorBlock flaw is a DoS issue.
- [11]
ABB's dynovaPRO vulnerability, which could allow account takeovers via a bypass in the credential reset flow, was among advisories published between the previous Patch Tuesday and this one.
- [12]
ABB said it is not aware of any in-the-wild exploitation of the dynovaPRO vulnerability.
- [13]
"Internal log analysis identified 26 password change events affecting 9 customers, which may indicate testing or reconnaissance activity."
- [14]
CISA published two new ICS advisories on Tuesday: one covers Swann SWIFI-SE2KIC camera vulnerabilities exposing video information, and the other covers a privilege escalation issue in Inductive Automation's Ignition product.
- [15]
Germany's CERT@VDE published one new advisory about an information disclosure vulnerability affecting Bender's Customer&Partner platform.
- [16]
Siemens, Schneider Electric and Rockwell Automation together published 20 new advisories this Patch Tuesday.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- securityweek.comICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.