ICS Critical Patch Updates: August 2025 

Aug 14, 2025 | blog

Welcome to Foxguard’s ICS Critical Patch Updates for August 2025, your trusted monthly briefing on critical and high-severity vulnerabilities impacting Industrial Control Systems (ICS) and Operational Technology (OT) environments. 

In August, a diverse array of advisories from Siemens, Schneider Electric, Rockwell, ABB, Phoenix Contact, and CISA addressed critical and high-severity vulnerabilities impacting everything from industrial control systems and operational technology to vital transportation infrastructure. 

Note on CVSS Scores: Many vendors still rely predominantly on CVSS v3.1 for scoring vulnerabilities, but the use of CVSS v4.0 is gradually increasing for newer disclosures. In this blog, we’ve included the scores as published in vendor advisories to ensure you have the most accurate representation of severity for each vulnerability. 

Below is a roundup of the most relevant advisories released this month and insights from Foxguard’s team to help you prioritize your patching and mitigation efforts. 

Siemens 

Siemens has released multiple security advisories this month, many of which are high and critical. Key vulnerabilities include: 

  • Vulnerability in Nozomi Guardian/CMC on RUGGEDCOM APE1808 Devices (Multiple Vulnerabilities – CVSS v3.1 7.2 / CVSS v4.0 7.5): An OS command injection vulnerability and privilege escalation risk affect Nozomi Guardian/CMC. Siemens is preparing fixes and recommends countermeasures and contacting customer support in the interim. 

Foxguard Insight: With a recurring theme of vulnerabilities in third-party components and deserialization flaws, this month’s Siemens advisories highlight a concentration of risks in engineering platforms like COMOS and Femap, as well as perimeter devices like RUGGEDCOM and SINEC. Foxguard recommends a holistic security approach that prioritizes patching these systems, restricts access, and disables unnecessary services like VNC and BIST mode to minimize the attack surface. 

Schneider Electric 

Schneider has released five security advisories, many of them high and critical. 

Foxguard Insight: Schneider Electric’s August advisories highlight significant vulnerabilities in both data acquisition platforms (EcoStruxure) and core automation controllers (Modicon M340 and Saitel RTUs). The high CVSS scores associated with deserialization and web server exposure demonstrate the critical risks of unauthorized access and data tampering. Foxguard emphasizes the need for operators to prioritize firmware updates and implement network segmentation to protect these critical assets. 

Rockwell Automation 

Rockwell has released one security advisory: 

Foxguard Insight: While this vulnerability is in a simulation tool, not an operational controller, it poses a significant risk to the OT environment. Compromising an engineering workstation could serve as a foothold for a broader attack. Foxguard recommends securing the entire OT network, including all non-operational software that interacts with it. 

ABB 

ABB has released one security advisory: 

Foxguard Insight: The ABB advisory reinforces a recurring challenge in OT security: vulnerabilities for which no patches are available. In these situations, asset owners must rely on compensatory controls like network isolation, firewalls, and restricted access to minimize risk. This is a critical reminder of the importance of a defense-in-depth strategy. 

Phoenix Contact 

Phoenix Contact has released one security advisory: 

  • Device and Update Management Windows Installer Privilege Escalation (CVE-2025-41686 – CVSS v3.1 7.8): A privilege escalation vulnerability exists in Device and Update Management prior to version 2025.3.1. This could allow a low-privileged local user to execute arbitrary code with administrative privileges. Phoenix Contact recommends updating to version 2025.3.1. 

Foxguard Insight: This advisory highlights the risks associated with local threats. A malicious insider or an attacker with physical access could exploit this flaw to gain administrative privileges on a workstation. Foxguard recommends implementing strict access controls and physical security measures as a vital defense to mitigate such risks. 

CISA 

CISA has released seven security advisories, many of them high and critical. 

  • End-of-Train and Head-of-Train Remote Linking Protocol (CVE-2025-1727 – CVSS v4.0 7.2): This could allow attackers to send unauthorized brake control commands to EoT/HoT devices, disrupting operations or inducing brake failure. Affected vendors include Wabtec and Siemens. 

Foxguard Insight: CISA’s August advisories are a stark reminder of the breadth of ICS risks, from building access systems (Johnson Controls) and medical imaging servers (Santesoft) to critical transportation infrastructure (EoT/HoT protocols). The inclusion of three new vulnerabilities to CISA’s Known Exploited Vulnerabilities Catalog signals that these are actively being used in attacks. It is paramount for asset owners to prioritize remediation for these and other high-severity flaws, especially those with remote code execution potential. 

Actionable Recommendations 

Reflecting the varied nature of this month’s advisories, our recommendations focus on key themes such as securing engineering platforms, mitigating unpatched vulnerabilities, and hardening network boundaries against a range of remote and local threats: 

  1. Prioritize critical remote exploitation paths: Focus on patching high-severity flaws with remote code execution, such as deserialization vulnerabilities in Siemens Engineering Platforms and authentication bypasses in RUGGEDCOM and SINUMERIK devices. 
  1. Patch where possible, mitigate where not: Apply available updates immediately for high-risk assets like Schneider’s Modicon controllers. For vulnerabilities with no patch, such as with some ABB ASPECT products, implement compensating controls and restrict network exposure. 
  1. Audit file handling procedures: As seen with Rockwell Arena and Siemens COMOS, enforce that engineering workstations only process files from trusted sources to prevent code execution via malicious files. 
  1. Harden ICS network boundaries: Enforce segmentation between OT and IT, apply allow-listing rules, and monitor for unusual traffic to protect against protocol-level and web server attacks. 
  1. Address vendor-confirmed unpatched vulnerabilities: Implement strict isolation and compensating controls for devices with known vulnerabilities but no available patch. Regularly audit these controls to ensure they remain effective. 

How Foxguard Can Help 

Addressing ICS vulnerabilities can be overwhelming, but Foxguard offers tailored solutions to simplify security management and protect critical infrastructures. 

Our services include: 

  • FOXGUARD DISCOVER: Asset and network visibility solution for ICS and OT environments, providing real-time visibility of critical assets, detecting vulnerabilities, and offering actionable insights to enhance security posture. 
  • FOXGUARD CYBERWATCH: Asset and vulnerability management platform that monitors, manages, and remediates security risks across ICS and OT environments, ensuring compliance and reducing overall cyber risk. 
  • FOXGUARD PATCHINTEL: Patch intelligence service that provides patch availability reports to identify available security updates, and a secure supply chain to acquire and validate patch binaries for improved patch management and compliance. 
  • FOXGUARD DEPLOY: Patch distribution and deployment solution that securely applies validated patches across ICS and OT systems, ensuring timely and effective patch management to maintain security. 
  • FOXGUARD MANAGED SERVICES: Provides Patch Management as a Service (PMaaS) and Vulnerability Management as a Service (VMaaS) to continuously assess, prioritize, and address security risks in ICS and OT environments, helping maintain security compliance and operational integrity. 

Backed by years of expertise and trusted by numerous clients worldwide, Foxguard provides the essential tools and insights that empower critical infrastructure operators to stay ahead of emerging cyber risks. 

Stay Ahead of Threats 

The August advisories demonstrate how ICS threats are becoming more complex, with attackers exploiting supply chain weaknesses and targeting a wider range of systems. From common third-party components embedded in Siemens devices, to engineering workstations such as Rockwell’s Arena, and even critical transportation protocols flagged by CISA, no part of the environment is off-limits.  

These disclosures make it clear that a defense strategy focused solely on operational controllers is no longer enough. Organizations also need to protect development tools, tighten network defenses against protocol and deserialization flaws, and keep an eye on vulnerabilities lurking in embedded libraries. CISA’s change in how they distribute advisories back in May is a reminder that keeping up requires flexible monitoring and alerting—relying on a single channel isn’t enough to catch everything. 

If your organization requires support in managing ICS vulnerabilities, contact Foxguard today. 

Your security is our priority. Stay vigilant and stay protected. 

Contact us

Contact our experts. We’ll do our best to get back to you within 24 hours.

Contact us
Discover our customer stories