Review – 5 Advisories and 2 Updates Published – 3-18-25

Today CISA’s NCCIC-ICS published five control system security advisories for products from Schneider (4) and Rockwell. They also updated advisories for products from Mitsubishi and Schneider.

Advisories

Schneider Advisory #1 - This advisory describes four vulnerabilities in the Schneider ASCO 5310/5350 Remote Annunciator.

Schneider Advisory #2 - This advisory describes an insertion of sensitive information into log file vulnerability in the Schneider EcoStruxure Panel Server.

Schneider Advisory #3 - This advisory describes an insecure default initialization of resource vulnerability in the Schneider EcoStruxure Power Automation System.

Schneider Advisory #4 - This advisory describes an improper authentication vulnerability in the Schneider EcoStruxure Power Automation System User Interface (EPAS-UI).

Rockwell Advisory - This advisory discusses three vulnerabilities (all listed in CISA’s Known Exploited Vulnerability catalog) in the Rockwell products using Lifecycle Services with VMware.

Updates

Mitsubishi Update - This update provides additional information on the CNC Series advisory that was originally published on October 17^th, 2024, and most recently updated on February 20^th, 2025.

Schneider Update - This update provides additional information on the Modicon advisory that was originally published on December 17^th, 2024.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/5-advisories-and-2-updates-published-a61 - subscription required.