Siemens, Bosch, and Schneider Electric report major cybersecurity vulnerabilities

Multiple major industrial and technology companies have reported significant cybersecurity vulnerabilities affecting various hardware and software products.

Siemens released a monthly security bulletin identifying 746 vulnerabilities. These include 40 critical and 330 high-severity flaws affecting a wide range of products, such as SIMATIC IPC series, RUGGEDCOM devices, and various SIMATIC S7-1500 and WinCC software versions. Additionally, vulnerabilities were noted in Rockwell Automation’s 1732E ArmorBlock I/O.

Bosch Rexroth has identified a high-severity heap-based buffer overflow vulnerability in its PRI7000 products, which could allow for arbitrary code execution. This flaw is related to the processing of compressed XZ data within a 7-Zip component.

Schneider Electric is also facing multiple high-severity vulnerabilities affecting several SAGE RTU models, including the 1410, 1430, 1450, 2400, 3030 Magnum, and 4400 series. These flaws were identified by researchers from the U.S. Department of Energy’s CyTRICS program, Lawrence Livermore National Laboratory, and Sandia National Laboratories, as well as through internal Schneider Electric investigations.