Siemens Industrial Edge Device Kit access restriction issues
Original title: Siemens Industrial Edge Device Kit
Industrial Edge Device Kit versions V1.10 to V1.26 allow authenticated remote access to sensitive information; update to V1.26.2-1, V1.27.1-1 or V1.28.0-6 recommended for affected ranges.
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data. No fix planned for most versions; updates available for V1.26.2-1, V1.27.1-1 and V1.28.0-6. Remediations include limiting network access to trusted parties only.
- No fix planned for versions V1.10 to V1.25 and V1.11 to V1.24
- Updates to V1.26.2-1, V1.27.1-1 and V1.28.0-6 available
- Limit network access to trusted parties
- Known affected: Industrial Edge Device Kit - arm64 and x86-64 variants
Impact: access sensitive internal information leading to unauthorized access or data deletion
| Product | Affected | Fixed in |
|---|---|---|
| Siemens Industrial Edge Device Kit | V1.10, V1.11, V1.12, V1.13, V1.14, V1.15, V1.16, V1.17, V1.18, V1.19, V1.20, V1.21, V1.22, V1.23, V1.24, V1.25, V1.26, V1.27, V1.28 | V1.26.2-1, V1.27.1-1, V1.28.0-6 |
- 1.Limit network access to affected products to trusted parties only
- Vendors
- Siemens
- Products
- Industrial Edge Device Kit
- Organizations
- CISA
From the original article
13 min read at cisa.govView CSAF Summary Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.