Summary
Industrial Edge Management contains a vulnerability that could allow an unauthenticated attacker to spoof a trusted entity by interfering in the communication path between the Industrial Edge Management (IEM) and the Industrial Edge Hub (IEH) using a crafted certificate.
An attacker could use this to inject malicious maintenance requests (e.g. sending statistics, activating remote support, exchanging the initial keys when onboarding, querying new extensions).
Siemens has released an update for the Industrial Edge Management and recommends to update to the latest version.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does n…
Revision history
-
#1
Publication Date
References
-
SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-649853.pdf
-
SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-649853.txt