EUVD-2026-98390
GHSA-rc9q-86jg-3j8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain on-path network position (MitM)
-
DeliveryPresent forged TLS certificate
-
ExploitClient fails to validate certificate
-
ExecutionIntercept and relay traffic
-
ImpactSpoof trusted server and tamper data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | Exploitation requires the attacker to first establish a privileged man-in-the-middle position on the communication path between the Industrial Edge App Publisher client and its intended server (reflected by CVSS AT:P), and requires the victim client to initiate a TLS connection (UI:P). The flaw is the absence of server certificate validation during TLS handshake, so any presented certificate - including attacker-controlled, self-signed, or forged certificates - is accepted. Limiting factors: the attacker cannot exploit this purely remotely without on-path access, so segmented/trusted OT networks and the need to intercept live client connections meaningfully constrain real-world exploitation despite the PR:N/AV:N metrics. Affects all versions below V1.27.9. |
| Impact | This is a legitimate medium-to-high severity concern but not an emergency-priority issue based on available signals. The CVSS 4.0 base score of 7.6 (vendor-provided by Siemens) reflects AV:N with PR:N (no privileges) but is tempered by AT:P (the attacker must engage in attack requirements - i.e., establish a privileged on-path/MitM position) and UI:P (passive user interaction, the victim must initiate a TLS connection via the App Publisher). High confidentiality and integrity impact (VC:H/VI:H) with no availability impact aligns with a certificate-validation flaw (CWE-295) enabling interception and relay. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis. The conflict to note: the vector advertises AV:N/PR:N which can read as trivially remote, but AT:P plus the MitM nature means an attacker must already control or inject into the network path - this materially raises the practical bar and makes opportunistic internet-wide exploitation unlikely. Realistic exposure is concentrated in OT/industrial network environments where an adversary has gained a foothold enabling traffic interception. Treat as a patch-in-maintenance-window item rather than a drop-everything priority. |
| Exploit ScenarioDerived | An attacker positioned on the network path between an Industrial Edge App Publisher client and its intended server (e.g., via ARP spoofing, rogue Wi-Fi/gateway, or compromised network segment in an OT environment) presents a fraudulent or self-signed TLS certificate. Because the software does not validate the server certificate, the client accepts the connection, allowing the attacker to transparently relay, read, and tamper with the communication while impersonating the trusted server. No public exploit code is identified; exploitation requires achieving the on-path position and the victim initiating the TLS connection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Oct 13, 2026
Siemens Industrial Edge App Publisher versions prior to V1.27.9 fail to validate the server certificate when establishing TLS connections, allowing an attacker who already occupies a privileged man-in-the-middle position on the network path to intercept, relay, and spoof trusted server communication. The flaw is unauthenticated from a credential standpoint (CVSS vector PR:N) but requires on-path access plus victim-initiated connection activity (AT:P, UI:P), so exploitation is constrained to environments where an adversary can insert themselves between the client and the intended server - a meaningful hurdle in segmented industrial networks where App Publisher normally operates. No public exploit code or in-the-wild activity has been identified at time of analysis, and the practical risk is medium-to-high rather than emergency priority: integrity and confidentiality of publisher-to-server traffic are fully exposed (C:H/I:H), while availability is unaffected (A:N).
Earlier versions of this analysis (2)
Missing TLS server-certificate validation in Siemens Industrial Edge App Publisher (all versions before V1.27.9) lets an attacker who already occupies a man-in-the-middle position on the network path intercept and relay the client's TLS connections and impersonate the intended server, resulting in high confidentiality and integrity impact (CWE-295). The flaw requires no credentials (unauthenticated from the client's perspective) but is not exploitable by a remote attacker without path control, because the attack depends on capturing or redirecting the traffic and on the user initiating the connection; Siemens scores it 7.6 under CVSS 4.0, while an independent assessment maps it to CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. There is no public exploit code identified at time of analysis and the CVE is not in CISA KEV, so this is a moderate-severity trust/transport weakness rather than a default-configuration zero-interaction compromise; the vendor has published the fix in V1.27.9.
Missing TLS server certificate validation in Siemens Industrial Edge App Publisher (all versions before V1.27.9) allows an attacker who already occupies the communication path to impersonate the intended server and read or modify data in transit, producing high confidentiality and integrity impact (CVSS 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). No authentication or user interaction is required, but exploitation depends on first obtaining and holding a man-in-the-middle position - adjacent network access, ARP/DNS spoofing, or control of an intermediate hop - which is the primary limiting factor and the reason for the High attack-complexity rating. No public exploit has been identified at time of analysis, the issue is not listed on CISA KEV, and Siemens has published V1.27.9 as the fixed version; overall this is a moderate-priority flaw rather than an emergency. The affected utility is used by developers and engineers to package and publish applications to Industrial Edge devices, so a successful relay could expose credentials or tamper with artifacts being deployed.
RemediationAI
Upgrade Industrial Edge App Publisher to V1.27.9 or later, which is the vendor-stated fixed version; this is the only complete remediation because the defect is in the client's TLS verification logic itself. Siemens documents the release in advisory SSA-968435 at https://cert-portal.siemens.com/productcert/html/ssa-968435.html - verify the installed build number there rather than relying on the version string alone, since App Publisher is often deployed as a desktop tool outside standard patch pipelines. Where immediate upgrade is not feasible, the practical compensating control is network-path hardening: place App Publisher workstations and the servers they contact inside the same trusted, segmented OT zone and block inbound/inter-domain routing that would let an adversary terminate a TLS session on the path (this restores much of the security the missing certificate check was meant to provide, at the cost of restricting legitimate remote administration and cross-zone engineering workflows). Additional compensating measures include pinning the expected server identity at the DNS/hosts level so the client cannot be steered to a rogue endpoint, and monitoring for unexpected TLS endpoints or certificates on the App Publisher traffic path. Because the vulnerability cannot be triggered off-path, aggressive perimeter egress filtering from the engineering network reduces exposure further, though it will break any legitimate cloud-based app publishing that traverses those boundaries. No vendor-released patch alternative or CLI configuration flag to enforce certificate validation is described in the available data, so the upgrade should be treated as mandatory rather than optional. Note that patching does not require credential rotation, as no authentication bypass is involved.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-295, Improper Certificate Validation. Industrial Edge App Publisher acts as a client that opens TLS sessions to backend/edge management infrastructure, and the implementation accepts whatever certificate the peer presents without verifying that it chains to a trusted CA, matches the expected hostname, or is unexpired and unrevoked. Because the handshake succeeds against attacker-supplied, self-signed, or forged certificates, the transport encryption provides no authentication guarantee - an adversary on the path can terminate the client's TLS session and open a separate session to the real server, transparently relaying traffic (a classic active MitM / relay). This is distinct from a cipher-suite or protocol-version weakness: the cryptography may be sound, but the identity binding that TLS is supposed to provide is absent. The affected CPE, cpe:2.3:a:siemens:industrial_edge_app_publisher:*:*:*:*:*:*:*:*, covers all released versions below the V1.27.9 fix line, so every deployment that has not been upgraded is exposed. The attacker's position requirement (CVSS 4.0 AT:P, assessed CVSS 3.1 AC:H) is the key mitigating factor - this cannot be triggered by a purely remote, off-path attacker, and the client must actively initiate a connection during the window of interception.
Know when Industrial Edge App Publisher gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
MitM positioning makes it AC:H rather than trivial; no privileges needed (PR:N) but victim must initiate the TLS connection (UI:R); interception yields high C and I, no availability impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.
Executive ViewAI
Siemens Industrial Edge App Publisher (versions before V1.27.9) has a high-severity flaw that could let an attacker positioned on the network silently intercept and alter communications between the publisher and servers. Organizations relying on this tool for industrial application management face potential data exposure and integrity risks, though exploitation requires a privileged network position and no public exploit has been identified at time of analysis. Given the absence of a vendor patch, leadership should prioritize network segmentation and monitoring to mitigate exposure while awaiting a fix.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation, strict firewall rules to limit on-path access, monitoring for anomalous TLS traffic, and restricting publisher communications to trusted networks. Consider TLS inspection where feasible to detect certificate validation failures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB