1.0 Introduction

Recently, CISA released six Industrial Control Systems (ICS) advisories on March 16, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

2.0 Affected Products

• Siemens SCALANCE, RUGGEDCOM Third-Party
• Siemens RUGGEDCOM CROSSBOW V5.3
• Siemens RUGGEDCOM CROSSBOW V5.2
• Siemens SCALANCE W1750D Devices
• Siemens Mendix SMAL Module
• Honeywell OneWireless Wireless Device Manager
• Rockwell Automation Modbus TCP AOI Server
• AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere (Update A)

4.0 Recommendations
MyCERT encourages users and administrators to review the newly released ICS advisories for technical details and mitigations:

• ICSA-23-075-01 Siemens SCALANCE, RUGGEDCOM Third-Party – https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-01
• ICSA-23-075-02 Siemens RUGGEDCOM CROSSBOW V5.3 – https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-02
• ICSA-23-075-03 Siemens RUGGEDCOM CROSSBOW V5.2 – https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-03
• ICSA-23-075-04 Siemens SCALANCE W1750D Devices – https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-04
• ICSA-23-075-05 Siemens Mendix SMAL Module – https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-05
• ICSA-23-075-06 Honeywell OneWireless Wireless Device Manager – https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-06
• ICSA-23-075-07 Rockwell Automation Modbus TCP AOI Server – https://www.cisa.gov/news-events/ics-advisories/icsa-23-075-07
• ICSA-22-342-02 AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere (Update A) – https://www.cisa.gov/news-events/ics-advisories/icsa-22-342-02

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.