ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw

This month's ICS Patch Tuesday brought a heavy round of disclosures from Siemens, Schneider Electric, and Rockwell Automation. Siemens released 17 advisories, fixing critical bugs in certain Simatic S7-1500 CPUs (over 400 flaws tied to the GNU/Linux subsystem), Industrial Edge devices, and the Ruggedcom Crossbow Station Access Controller, alongside high- and medium-severity issues across products like Simatic IPC, WinCC, Desigo, Talon, and Capital Embedded AR Classic. Schneider Electric disclosed two high-severity bugs affecting Pro-face STW6000/Harmony STW6 (device takeover via a malicious webpage) and Sage RTUs (malicious firmware installation by a privileged user). Rockwell Automation's advisory covers two 1732E ArmorBlock vulnerabilities, including a critical flaw letting an unauthenticated attacker reset the web server password and seize admin control, plus a denial-of-service issue. CISA also published advisories for Swann SWIFI-SE2KIC cameras and an Ignition privilege-escalation bug, while Germany's CERT@VDE flagged an information-disclosure issue in Bender's Customer&Partner platform; ABB separately noted anomalous password-reset activity tied to a dynovaPRO credential-reset bypass (CVE-2026-18963) affecting nine customers.