Siemens Industrial Edge Device Kit path traversal flaw
Siemens Industrial Edge Device Kit improperly restricts internal API/path access, letting authenticated attackers read sensitive data or delete files.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an advisory for Siemens Industrial Edge Device Kit (arm64 and x86-64 builds) describing a path traversal weakness (CWE-35) in which affected systems fail to properly restrict access to internal APIs and paths for authenticated users. An authenticated remote attacker could exploit this to access sensitive internal information, which could in turn facilitate unauthorized access to the system or result in deletion of data.
The advisory covers a very broad range of versions across both architectures, from V1.5 through V1.28. Versions prior to V1.26.2-1, V1.27.1-1, and V1.28.0-6 have vendor fixes available and should be updated. For all other listed versions (V1.5 through V1.25 and the arm64/x86-64 variants), Siemens has stated no fix is currently planned, leaving network-access restriction as the only mitigation.
There is no indication in the advisory of active exploitation in the wild. Defenders operating Industrial Edge Device Kit should prioritize upgrading to the patched versions where available, and for unpatched versions, strictly limit network access to trusted parties only, following general industrial control system security best practices (network segmentation, firewalling management interfaces, and minimizing exposure of edge devices to untrusted networks).
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-09
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,577 reports from 147 sources, 727 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs