Siemens Industrial Edge devices leak internal data to authenticated users

Authenticated remote attackers can read sensitive Industrial Edge internals; some devices are patched and many HMI panels are not.

CISA advisories say affected Siemens Industrial Edge systems do not properly restrict authenticated users from internal APIs and paths. An authenticated remote attacker could read sensitive internal information and, in the worst case, use it for unauthorized access or to delete data. IECD, IEOD, and IEVD before V1.28.1 are known affected, as are SCALANCE LPE9413 and LPE9433. SIMATIC IoT2050 and IPC BX-21A are fixed in V1.28.1-2, and several SIMATIC IPC Industrial Edge devices in V3.2.0-17. Industrial Edge Device Kit arm64 and x86-64 builds from V1.10 to V1.26 are affected; Siemens offers V1.26.2-1, V1.27.1-1, and V1.28.0-6 for affected ranges and plans no fix for most earlier kit versions. Listed SIMATIC HMI MTP1200 and MTP1500 panels have no fix; Siemens advises limiting network access to trusted parties.