Summary
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information).
Industrial Edge Device Kit contains an authorization bypass vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user.
Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 1
-
Critical 10.0
Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauth…
Revision history
-
#2
Initial Republication of Siemens ProductCERT SSA-014678 advisory
-
#1
Publication Date
References
-
SSA-014678: Authorization Bypass Vulnerability in Industrial Edge Device Kit - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-014678.html
-
ICS Advisory ICSA-26-015-09 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-09
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b