Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Siemens Industrial Edge devices leak internal APIs to logged-in users

Original title: Siemens Industrial Edge Devices

CISA Advisoriesby CISA ()9 min read
Read at cisa.gov
Part of a story covered by 3 sourcesSiemens Industrial Edge devices leak internal data to authenticated usersMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Some devices have versioned fixes, while listed SIMATIC HMI panels currently have no fix.

Affected Siemens Industrial Edge systems do not properly restrict authenticated users from internal APIs and paths. An authenticated remote attacker could read sensitive internal information, and in the worst case use it to gain unauthorized access or delete data. Fixes are stated for several Industrial Edge, IoT2050, and IPC devices. For numerous SIMATIC HMI MTP panels, the advisory says no fix is available and network access should be limited to trusted parties.

Unconfirmed: No CVE identifier is given in the excerpt, and SCALANCE fixed versions are not stated.

Key facts
  • IECD, IEOD, and IEVD before V1.28.1 are known affected.
  • SIMATIC IoT2050 and IPC BX-21A devices are fixed in V1.28.1-2.
  • Several SIMATIC IPC Industrial Edge devices are fixed in V3.2.0-17.
  • SCALANCE LPE9413 and LPE9433 are listed as known affected.
  • Listed SIMATIC HMI MTP1200 and MTP1500 panels have no fix available.
Security assessment · AI, from the article

Impact: Sensitive internal data access, possible unauthorized access or data deletion

ProductAffectedFixed in
Siemens Industrial Edge Cloud, Own, and Virtual Device< V1.28.1V1.28.1
Siemens SIMATIC IoT2050 Advanced IED and SM IED< V1.28.1-2V1.28.1-2
Siemens SIMATIC IPC BX-21A Industrial Edge Device< V1.28.1-2V1.28.1-2
Siemens SIMATIC IPC Industrial Edge devices including BX-39A, BX-59A, IPC127E, IPC227E, IPC227G, IPC427E, and IPC847E< V3.2.0-17V3.2.0-17
Siemens SIMATIC HMI MTP Comfort Pro and Unified Comfort Panels——
What to do
  1. 1.Update Industrial Edge, IoT2050, and IPC devices to the stated fixed versions.
  2. 2.Limit network access to affected products to trusted parties where no fix exists.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
siemensindustrial-edgesimatichmiicsaccess-control
Vendors
Siemens
Products
Industrial EdgeSIMATIC IoT2050SIMATIC IPCSIMATIC HMISCALANCE LPE

From the original article

9 min read at cisa.gov

View CSAF Summary Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.