Siemens Industrial Edge App Publisher before 1.27.9 vulnerable to RCE (CVE-2026-78556, CVE-2026-78557)
Update to V1.27.9 or later to prevent network attackers from impersonating the management server and achieving RCE via Node.js.
60
CVE-2026-78556
TLS cert validation flaw in Siemens Industrial Edge App Publisher
- CVSS 4.0
- 7.6 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Siemens Industrial Edge App Publisher before V1.27.9 does not properly validate the server certificate when it starts a TLS connection (CWE-295). An attacker who can sit on the path between the client and the intended server can intercept and relay traffic or impersonate a trusted server (a man-in-the-middle). That can expose or alter the contents of those sessions; availability of the product is not described as affected. The issue applies to every release older than V1.27.9. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade Industrial Edge App Publisher to V1.27.9 or later. Until then, restrict the network path between the publisher and its servers (trusted segments, no untrusted proxies) and confirm that TLS peers present expected certificates.
| Product | Affected |
|---|---|
| Siemens Industrial Edge App Publisher | all versions before V1.27.9 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.
- Weakness
- CWE-295
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X