Summary
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information).
Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information.
Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 2
-
Critical 9.1
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow a…
-
Medium 6.8
A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, I…
Revision history
-
#2
Initial CISA Republication of Siemens ProductCERT SSA-377139 advisory
-
#1
Publication Date
References
-
SSA-377139: Path Traversal Vulnerabilities in Industrial Edge Device Kit - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-377139.html
-
ICS Advisory icsa-26-295-09 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b