Summary
The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration.
Siemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version.
Vulnerabilities 2
-
High 8.3
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to…
-
High 7.4
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software do…
Revision history
-
#2
Initial CISA Republication of Siemens ProductCERT SSA-968435 advisory
-
#1
Publication Date
References
-
SSA-968435: Multiple Vulnerabilities in Industrial Edge App Publisher - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-968435.html
-
ICS Advisory icsa-26-295-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b