Industrial Edge Device Kit Arm64 V1 9
Monthly
Authenticated, privileged remote attackers on affected Siemens Industrial Edge Device Kit installations (arm64 and x86-64, versions 1.5 through 1.28) and the listed SIMATIC/SIPLUS HMI Unified Comfort panels can reach internal APIs and file paths that the software fails to restrict, exposing sensitive internal information and - per the vendor's description - potentially enabling further unauthorized system access or deletion of data. Siemens rates this CVSS 4.0 8.9 High (AV:N/AC:L/AT:P/PR:H/UI:N with full VC/VI/VA:H on the vulnerable system plus SC/SI/SA:H on subsequent systems); our independent assessment concurs with the high impact rating but emphasizes that the score is driven by impact breadth rather than ease of access, because exploitation requires a valid privileged session and an additional attack precondition is signalled by the AT:P metric. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Improper restrictions on internal APIs and file paths in Siemens Industrial Edge deployments - the Industrial Edge Device Kits for arm64 and x86-64 from V1.5 through V1.28, Industrial Edge Cloud Device (IECD), Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413/LPE9433, SIMATIC IoT2050 variants and the SIMATIC IPC BX-21A/BX-39A/BX-59A, IPC127E, IPC227E, IPC227G, IPC427E and IPC847E edge devices - allow an authenticated remote user to reach internal endpoints and resources beyond their intended authorization and read sensitive internal information, which in the worst case can be leveraged to facilitate unauthorized access to the system. The vendor score is CVSS 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only, scope-changing information-disclosure issue; the independent assessment reproduces the same vector but rates the privilege requirement as PR:L, so treating any authenticated user as a potential attacker is the safer assumption pending Siemens clarification. Exploitation requires network reachability to the device's management/internal API surface plus valid credentials, which in typical OT architectures confines risk to segmented industrial networks; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.
Authenticated, privileged remote attackers on affected Siemens Industrial Edge Device Kit installations (arm64 and x86-64, versions 1.5 through 1.28) and the listed SIMATIC/SIPLUS HMI Unified Comfort panels can reach internal APIs and file paths that the software fails to restrict, exposing sensitive internal information and - per the vendor's description - potentially enabling further unauthorized system access or deletion of data. Siemens rates this CVSS 4.0 8.9 High (AV:N/AC:L/AT:P/PR:H/UI:N with full VC/VI/VA:H on the vulnerable system plus SC/SI/SA:H on subsequent systems); our independent assessment concurs with the high impact rating but emphasizes that the score is driven by impact breadth rather than ease of access, because exploitation requires a valid privileged session and an additional attack precondition is signalled by the AT:P metric. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Improper restrictions on internal APIs and file paths in Siemens Industrial Edge deployments - the Industrial Edge Device Kits for arm64 and x86-64 from V1.5 through V1.28, Industrial Edge Cloud Device (IECD), Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413/LPE9433, SIMATIC IoT2050 variants and the SIMATIC IPC BX-21A/BX-39A/BX-59A, IPC127E, IPC227E, IPC227G, IPC427E and IPC847E edge devices - allow an authenticated remote user to reach internal endpoints and resources beyond their intended authorization and read sensitive internal information, which in the worst case can be leveraged to facilitate unauthorized access to the system. The vendor score is CVSS 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), a confidentiality-only, scope-changing information-disclosure issue; the independent assessment reproduces the same vector but rates the privilege requirement as PR:L, so treating any authenticated user as a potential attacker is the safer assumption pending Siemens clarification. Exploitation requires network reachability to the device's management/internal API surface plus valid credentials, which in typical OT architectures confines risk to segmented industrial networks; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.