Siemens released critical security patches for the firmware in its Ruggedcom WIN products which are used as broadband wireless base stations in industrial environments.
The updates fix three vulnerabilities, two of which have the maximum severity score in the Common Vulnerability Scoring System (CVSS) and could allow attackers to perform administrative functions or to execute arbitrary code on the affected systems without authentication.
Ruggedcom WIN products are compliant with the IEEE 802.16e wireless communications standard, also known WiMAX. They can be deployed as bases stations or subscriber units and are designed to withstand operation in harsh environments.
“According to Siemens, these devices are deployed across several sectors including Chemical, Communications, Critical Manufacturing, Dams, Defense Industrial Base, Energy, Food and Agriculture, Government Facilities, Transportation Systems, and Water and Wastewater Systems,” the U.S. Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) said in a security advisory. “Siemens estimates that these products are used worldwide.”
The vulnerabilities affect the WIN51xx, WIN52xx, WIN70xx and WIN72xx product series, Siemens said in its own advisory.
In addition to installing the new firmware updates, the company recommends that users protect network access to all products except for perimeter devices.