Skip to content
NewA calmer, faster ZeroHour
Advisoryhigh

Siemens Industrial Edge apps hit by Brotli Node2Shell flaw

Original title: Siemens Industrial Edge Management

CISA Advisoriesby CISA ()4 min read1
Read at cisa.gov
Part of a story covered by 6 sourcesCISA republishes Siemens fixes and gaps for Node2Shell Brotli flawMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-111497 is a CVSS 9.8 out-of-bounds write; several configurators have fixes, while others still need mitigations.

CISA republished Siemens guidance on Node2Shell (CVE-2026-111497), a buffer overflow in Google Brotli 1.0.3 through 1.2.0. A remote unauthenticated attacker can use a crafted Brotli stream to corrupt decoder memory, leak data, cause denial of service, or potentially run code. Siemens says setups with no Management Applications need no action, and Hub and Management Cloud already have firewall or WAF protection. Fixes exist for several configurators; others have none yet.

Unconfirmed: Siemens says it is still assessing Node2Shell's impact on Industrial Edge.

Key facts
  • Cloud Connector Configurator is fixed in V1.24.3 or later.
  • Data Flow Monitoring is fixed in V3.0.18 or later.
  • Common Configurator on IEM and on Edge have no fix yet.
  • Industrial Edge Hub was fixed on the cloud service starting October 29.
  • Brotli users should move to 1.0.10, 1.1.1, or 1.2.1.
Security assessment · AI, from the article

Impact: Memory corruption, data disclosure, denial of service, or code execution

ProductAffectedFixed in
Siemens Cloud Connector Configurator< V1.24.3V1.24.3 or later
Siemens Data Flow Monitoring< V3.0.18V3.0.18 or later
Siemens Databus Configurator< V4.0.1V4.0.1 or later
Siemens DataXess Configurator< V1.5.7V1.5.7 or later
Siemens Edge OPC UA Server Configurator< V2.3.10V2.3.10 or later
Siemens Flow Creator Configurator< V1.15.1V1.15.1 or later
Siemens Common Configurator (CC on IEM)all—
Siemens Common Configurator on Device (CC on Edge)all—
Google Brotli1.0.3 through 1.2.01.0.10 or 1.1.1 or 1.2.1
What to do
  1. 1.Update listed configurators to the stated fixed versions.
  2. 2.Uninstall Management Applications and protect IEM with a firewall or WAF until a fix exists.
  3. 3.Stop Common Configurator on Device until a fix is available.
Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-111497
ATT&CK
T1190 Exploit Public-Facing Application
Tags
siemensindustrial-edgebrotliicsnode2shellout-of-bounds-write
Vendors
SiemensGoogle
Products
Industrial Edge ManagementBrotliCloud Connector ConfiguratorCommon ConfiguratorData Flow MonitoringDatabus ConfiguratorDataXess ConfiguratorEdge OPC UA Server ConfiguratorFlow Creator ConfiguratorIndustrial Edge Hub
Organizations
CISASiemens ProductCERT
Countries
Germany

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111497
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
9.283%KEVPoC ×25
KEV

From the original article

4 min read at cisa.gov

View CSAF Summary Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the affected Brotli library is included in the IEM software stack, the affected functionality is not used or exposed.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.