CISA's industrial control systems team published a dense tranche of advisories on 21–22 September: eight covering Siemens products — Siveillance Control (icsa-26-265-03), SIPLUS and SIMATIC Products (04), the Desigo CC family (05), Industrial Edge Management (06), SIMOVE Fleetmanager and SIPLANT (07), WTV676 and WTV776 (08) — alongside OpenPLC Runtime v3 (09) and the lwIP lightweight TCP/IP stack (01–02). The spread is the interesting part: Desigo CC and Siveillance Control sit in building management and physical security, Industrial Edge Management in the industrial-DMZ layer that connects plant networks to the cloud, and OpenPLC is open-source logic-controller software used in small and research environments where patch discipline is thin. Advisories of this shape matter to the sector because the products are the ones asset owners cannot easily take offline — building management platforms run continuously and are frequently reachable from corporate networks. Repair guidance is vendor and version specific, and the advisories should be read against the operator's own asset inventory rather than treated as a single patch event.

• Source article