Summary
Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
High 7.1
A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industria…
Revision history
-
#2
Initial CISA Republication of Siemens ProductCERT SSA-609469 advisory
-
#1
Publication Date
References
-
SSA-609469: Authorization Bypass Vulnerability in Industrial Edge Management - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-609469.html
-
ICS Advisory ICSA-26-111-11 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-11
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b