Siemens Flags High-Severity Flaws and Node2Shell Exposure

Industrial technology vendors led by Siemens and Schneider Electric have released security advisories detailing multiple vulnerabilities across operational technology and supervisory software. Siemens published nine advisories covering 10 security vulnerabilities, including high-severity flaws and exposure to the Node2Shell vulnerability. Affected systems include Simatic SCADA, PCS 7, and ROS#, creating risks of code injection, arbitrary code execution, and system compromise. Schneider Electric, Phoenix Contact, Johnson Controls, Hitachi Energy, and Germany's VDE CERT also disclosed flaws. Malaysian operational technology administrators who detect anomalous industrial control traffic can report incidents to Cyber999 for national coordination.

Key Facts

What Flaws Did Siemens Disclose in Its Industrial Systems?

Siemens published nine security advisories addressing ten vulnerabilities across its industrial software and automation portfolio. The flaws range from high-severity issues enabling arbitrary code execution and system compromise to lower-severity firewall defects. Two advisories address exposure to Node2Shell, though Siemens has observed no targeted attacks against its deployments.

The high-severity flaws impact ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Meta-iot2050, Simatic WinCC Graphics Designer, and Simatic SCADA and PCS 7. Attackers exploiting these weaknesses can execute arbitrary code, inject code, access unauthorised data, and compromise systems. Siemens also noted a low-severity flaw resolved in the Fortigate NGFW utilised by Ruggedcom APE1808 devices. Because patches remain unavailable for several affected platforms and certain older versions will not receive updates, administrators must review product-specific mitigation notices.

Siemens confirmed that patches are not yet available for several affected products and that some versions will not receive fixes.

Are Industrial Systems Facing Active Exploitation from Node2Shell?

Exploitation attempts involving the Node2Shell vulnerability have been spotted in the wild, but investigators report no evidence of attacks specifically aimed at Siemens equipment. Security advisories confirm that two Siemens product lines carry exposure to Node2Shell, requiring administrators to implement protective mitigations whilst software updates remain pending.

Node2Shell represents a supply-chain vulnerability affecting systems incorporating the component. While threat activity targeting Node2Shell has been detected across the broader internet, Siemens stated there is no indication that attacks are specifically targeting its products. However, leaving industrial automation tools unmitigated poses significant operational risk should automated scanning tools discover accessible industrial interfaces.

Security researchers have spotted in-the-wild exploitation attempts for Node2Shell without any indication of attacks specifically targeting Siemens products.

Which Other Industrial Technology Vendors Issued Security Advisories?

Schneider Electric, Johnson Controls, Phoenix Contact, Hitachi Energy, and Germany's VDE CERT published advisories addressing vulnerabilities across industrial hardware and management software. Reported weaknesses range from credential harvesting and privilege escalation to arbitrary code execution triggered through malicious project files and third-party software dependencies like PHP.

Schneider Electric reported a medium-severity arbitrary code execution flaw in EcoStruxure Power Build Rapsody triggered by processing malicious files. Germany's VDE CERT published eight advisories for Beckhoff, MB Connect Line, Helmholz, Weidmueller, Bender, and Ads-Tec products, many linked to third-party issues including PHP (PHP2Shell). Phoenix Contact and Hitachi Energy similarly reported exposure to PHP2Shell, with Phoenix Contact also noting vulnerabilities in PLCnext. Johnson Controls addressed credential exposure in the C•CURE 9000 3.20 / Victor 8.0 installer alongside three EasyIO Neo IO Manager flaws, including one allowing privilege escalation and arbitrary code execution.

Johnson Controls warned that an installer vulnerability in C•CURE 9000 3.20 and Victor 8.0 could allow an attacker to obtain administrator credentials and authentication secrets.

What Should You Do?

• Apply vendor-recommended mitigations immediately for affected Siemens systems where official patches are not yet available or where products will not receive fixes.
• Avoid processing untrusted files within Schneider Electric EcoStruxure Power Build Rapsody to prevent arbitrary code execution.
• Implement security workarounds and patches across Johnson Controls installations running EasyIO Neo IO Manager or the C•CURE 9000 3.20 / Victor 8.0 installer to prevent credential exposure.
• Review exposure to third-party PHP2Shell vulnerabilities across hardware from Phoenix Contact, Hitachi Energy, and VDE CERT advisory vendors.
• Report suspected industrial cyber incidents or compromised control infrastructure in Malaysia to Cyber999 (MyCERT).

Common Questions

Which Siemens products are affected by high-severity flaws?

Siemens identified high-severity vulnerabilities in ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA and PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. These flaws allow attackers to inject code, execute arbitrary code, access unauthorised data, and compromise underlying systems.

Are security patches available for all affected Siemens systems?

No. Siemens stated that software patches are not yet available for several affected products. Additionally, certain product versions will not receive security fixes, making it essential for operational technology teams to review and implement the vendor's recommended mitigations.

What risk does the Johnson Controls installer flaw present?

The flaw affecting the Johnson Controls C•CURE 9000 3.20 and Victor 8.0 installer allows attackers to obtain administrator credentials and authentication secrets. Obtaining these credentials can allow malicious actors to escalate privileges or compromise physical security management infrastructure.

Sources and Methodology

This news dispatch is based exclusively on reporting published by SecurityWeek (ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure) authored by Eduard Kovacs. ROCKSTARmedia Infosec has not reviewed external vendor advisory pages or secondary databases for this summary.