MeridianMeridian

ICS Patch Tuesday: Siemens, Schneider Electric Disclose High-Severity Vulnerabilities and Node2Shell Exposure

Siemens has released nine new security advisories covering ten vulnerabilities across multiple industrial products, including high-severity issues in ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA, PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. Two of the advisories address the impact of the Node2Shell vulnerability, with exploitation attempts already observed in the wild though no targeted attacks against Siemens products have been confirmed. Schneider Electric published one advisory for a medium-severity flaw in EcoStruxure Power Build Rapsody that could enable arbitrary code execution via malicious files. Germany’s VDE CERT issued eight advisories affecting Beckhoff, MB Connect Line, Helmholz, Weidmueller, Bender, and Ads-Tec products, many involving third-party components such as PHP2Shell. Phoenix Contact, Johnson Controls, and Hitachi Energy also released advisories detailing risks in PLCnext, EasyIO Neo IO Manager, C•CURE 9000, and other systems, with some products lacking available patches.

SecurityWeekTranslated from English

Read at source

Siemens, Schneider Electric, and several other industrial technology vendors have published new security advisories describing vulnerabilities that could expose affected systems to serious attacks.

Siemens has published nine new advisories covering 10 vulnerabilities. Two advisories describe the impact of the recent Node2Shell vulnerability on the company’s products. Exploitation attempts of Node2Shell have been spotted, but there is no indication of attacks specifically targeting Siemens products.

Siemens has also published advisories informing customers about high-severity vulnerabilities in ROS#, Simcenter Femap, Mendix Studio Pro MCP Server, Simatic SCADA and PCS 7, Meta-iot2050, and Simatic WinCC Graphics Designer. A low-severity issue has been addressed in the Fortigate NGFW used by Ruggedcom APE1808 devices. The flaws can be exploited to inject code, execute arbitrary code, access unauthorized data, and compromise the system. Siemens says patches are not yet available for several affected products, and some versions will not receive fixes. Customers are advised to apply the recommended mitigations.

Schneider Electric has published only one advisory informing customers about a medium-severity issue in EcoStruxure Power Build Rapsody that could be exploited for arbitrary code execution by processing malicious files.

Germany’s VDE CERT published eight new advisories this week. They cover vulnerabilities found in Beckhoff, MB Connect Line, Helmholz, Weidmueller, Bender, and Ads-Tec products. Several of the security holes involve third-party components, including PHP (PHP2Shell).

In the days leading up to Patch Tuesday, Phoenix Contact also published advisories describing the impact of the PHP2Shell vulnerabilities. The company also released advisories for several vulnerabilities affecting PLCnext and other products.

Johnson Controls also published a couple of advisories earlier this month. One addresses three EasyIO Neo IO Manager vulnerabilities, including one that can allow privilege escalation and arbitrary code execution. The second describes an issue in the C•CURE 9000 3.20 / Victor 8.0 installer that could allow an attacker to obtain admin credentials and authentication secrets.

Hitachi Energy has confirmed that at least one of its products is affected by the PHP2Shell vulnerabilities.

SiemensPHP2ShellSchneider ElectricNode2ShellSimatic SCADAPhoenix ContactJohnson Controls
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Microsoft Resolves USB Audio Failures Introduced by September 2026 Security Updates
Vulns & Exploits

Microsoft Resolves USB Audio Failures Introduced by September 2026 Security Updates

Microsoft has confirmed that the November 2026 cumulative updates fix USB audio problems that began appearing after the September 2026 Patch Tuesday releases. The issues affected USB Audio Class 1.0 devices on both client systems running Windows 10 and Windows 11 as well as server platforms starting with Windows Server 2012. Symptoms included devices failing to start, Code 10 errors in Device Manager, unresponsive volume controls, and loss of multichannel features such as 3D audio or 8-channel output. Microsoft previously issued out-of-band fixes on September 14 for the multichannel-specific problems and has now addressed the remaining cases in the November security updates. Users who cannot install the updates immediately can mitigate the problem by switching affected devices to 2-channel mode. The company also resolved separate Outlook sign-in and mail delivery issues on Exchange Server systems caused by the October 2026 updates.

BleepingComputerNov 11, 2026Translated from English

CISA Adds Cisco BroadWorks CVE-2026-20320 to KEV Catalog After Active Exploitation in Telecom Attacks
Vulns & Exploits

CISA Adds Cisco BroadWorks CVE-2026-20320 to KEV Catalog After Active Exploitation in Telecom Attacks

The US Cybersecurity and Infrastructure Security Agency has added the high-severity Cisco BroadWorks vulnerability CVE-2026-20320 to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. The flaw stems from improper XML External Entity parsing in the Open Client Interface XML Parser, allowing unauthenticated remote attackers to read sensitive configuration files. Cisco patched the issue in August, but threat actors have since weaponized it against a European telecommunications provider and thirteen downstream organizations. Intelligence from Malbear Labs reveals the attack leveraged a jailbroken DeepSeek Flash AI model to exploit the BroadWorks XSP platform and extract private keys from the Provisioning Server. CISA has mandated federal agencies to remediate by November 24 under BOD 26-04 while urging all organizations to prioritize patching. This marks the 103rd Cisco vulnerability added to the KEV list since 2021.

BleepingComputerNov 11, 2026Translated from English

Threat Actors Exploit Openwave and Cisco BroadWorks Vulnerabilities to Steal Sensitive Telecom Data
Vulns & Exploits

Threat Actors Exploit Openwave and Cisco BroadWorks Vulnerabilities to Steal Sensitive Telecom Data

Threat actors are actively exploiting two vulnerabilities in Openwave Webtop Media Transcoder and Cisco BroadWorks to access sensitive information from communication service providers. The Openwave flaw, tracked as CVE-2026-111793, allows authenticated users to bypass file-type restrictions and convert unintended documents, potentially leading to sensitive data exposure. Patched in version 1.1.22.0 released in December 2021, the issue was added to CISA’s Known Exploited Vulnerabilities catalog on November 10. The Cisco BroadWorks vulnerability, CVE-2026-20320, is an unauthenticated blind XML external entity injection that enables remote attackers to read sensitive configuration data via the OCI-P service. Malbear Labs reported that a Chinese-speaking actor used an autonomous AI intrusion harness to target a European telecom provider and at least 13 of its customers, focusing on asset enumeration, credential theft, and subscriber record harvesting. CISA added both flaws to the KEV list with a November 24 patching deadline for federal agencies.

SecurityWeekNov 11, 2026Translated from English