Read the docs
TI-2024-36209 Aliases CVE-2024-54092GHSA-66rj-6jjf-mmhq

Weak authentication in Siemens Industrial Edge Device Kit - arm64 V1.17

Priority MEDIUM 49CWE-1390Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0077 55th percentileScored 2026-11-07
Fix Fixed Industrial Edge Device Kit - arm64 V1.20 (Siemens): V1.20.2-1Industrial Edge Device Kit - arm64 V1.21 (Siemens): V1.21.1-1+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensIndustrial Edge Device Kit - arm64 V1.17all versions—No fix listedCNA
SiemensIndustrial Edge Device Kit - arm64 V1.18all versions—No fix listedCNA
SiemensIndustrial Edge Device Kit - arm64 V1.19all versions—No fix listedCNA
SiemensIndustrial Edge Device Kit - arm64 V1.20before V1.20.2-1V1.20.2-1Patch availableCNA
SiemensIndustrial Edge Device Kit - arm64 V1.21before V1.21.1-1V1.21.1-1Patch availableCNA
SiemensIndustrial Edge Device Kit - x86-64 V1.17all versions—No fix listedCNA
SiemensIndustrial Edge Device Kit - x86-64 V1.18all versions—No fix listedCNA
SiemensIndustrial Edge Device Kit - x86-64 V1.19all versions—No fix listedCNA
SiemensIndustrial Edge Device Kit - x86-64 V1.20before V1.20.2-1V1.20.2-1Patch availableCNA
SiemensIndustrial Edge Device Kit - x86-64 V1.21before V1.21.1-1V1.21.1-1Patch availableCNA
SiemensIndustrial Edge Own Device (IEOD)before V1.21.1-1-aV1.21.1-1-aPatch availableCNA
SiemensIndustrial Edge Virtual Devicebefore V1.21.1-1-aV1.21.1-1-aPatch availableCNA
SiemensSCALANCE LPE9413before V2.1V2.1Patch availableCNA
SiemensSIMATIC IPC BX-39A Industrial Edge Devicebefore V3.0V3.0Patch availableCNA
SiemensSIMATIC IPC BX-59A Industrial Edge Devicebefore V3.0V3.0Patch availableCNA
SiemensSIMATIC IPC127E Industrial Edge Devicebefore V3.0V3.0Patch availableCNA
SiemensSIMATIC IPC227E Industrial Edge Devicebefore V3.0V3.0Patch availableCNA
SiemensSIMATIC IPC427E Industrial Edge Devicebefore V3.0V3.0Patch availableCNA
SiemensSIMATIC IPC847E Industrial Edge Devicebefore V3.0V3.0Patch availableCNA
  • Industrial Edge Device Kit - arm64 V1.17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Industrial Edge Device Kit - arm64 V1.18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Industrial Edge Device Kit - arm64 V1.19 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Industrial Edge Device Kit - arm64 V1.20 VendorSiemens Affected before V1.20.2-1 Fixed in V1.20.2-1 Patch available CNA
  • Industrial Edge Device Kit - arm64 V1.21 VendorSiemens Affected before V1.21.1-1 Fixed in V1.21.1-1 Patch available CNA
  • Industrial Edge Device Kit - x86-64 V1.17 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Industrial Edge Device Kit - x86-64 V1.18 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Industrial Edge Device Kit - x86-64 V1.19 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Industrial Edge Device Kit - x86-64 V1.20 VendorSiemens Affected before V1.20.2-1 Fixed in V1.20.2-1 Patch available CNA
  • Industrial Edge Device Kit - x86-64 V1.21 VendorSiemens Affected before V1.21.1-1 Fixed in V1.21.1-1 Patch available CNA
  • Industrial Edge Own Device (IEOD) VendorSiemens Affected before V1.21.1-1-a Fixed in V1.21.1-1-a Patch available CNA
  • Industrial Edge Virtual Device VendorSiemens Affected before V1.21.1-1-a Fixed in V1.21.1-1-a Patch available CNA
  • SCALANCE LPE9413 VendorSiemens Affected before V2.1 Fixed in V2.1 Patch available CNA
  • SIMATIC IPC BX-39A Industrial Edge Device VendorSiemens Affected before V3.0 Fixed in V3.0 Patch available CNA
  • SIMATIC IPC BX-59A Industrial Edge Device VendorSiemens Affected before V3.0 Fixed in V3.0 Patch available CNA
  • SIMATIC IPC127E Industrial Edge Device VendorSiemens Affected before V3.0 Fixed in V3.0 Patch available CNA
  • SIMATIC IPC227E Industrial Edge Device VendorSiemens Affected before V3.0 Fixed in V3.0 Patch available CNA
  • SIMATIC IPC427E Industrial Edge Device VendorSiemens Affected before V3.0 Fixed in V3.0 Patch available CNA
  • SIMATIC IPC847E Industrial Edge Device VendorSiemens Affected before V3.0 Fixed in V3.0 Patch available CNA

Remediation

  • Fix · CNA Industrial Edge Device Kit - arm64 V1.20 (Siemens) Fixed in V1.20.2-1
  • Fix · CNA Industrial Edge Device Kit - arm64 V1.21 (Siemens) Fixed in V1.21.1-1
  • Fix · CNA Industrial Edge Device Kit - x86-64 V1.20 (Siemens) Fixed in V1.20.2-1
  • Fix · CNA Industrial Edge Device Kit - x86-64 V1.21 (Siemens) Fixed in V1.21.1-1
  • Fix · CNA Industrial Edge Own Device (IEOD) (Siemens) Fixed in V1.21.1-1-a
  • Fix · CNA Industrial Edge Virtual Device (Siemens) Fixed in V1.21.1-1-a
  • Fix · CNA SCALANCE LPE9413 (Siemens) Fixed in V2.1
  • Fix · CNA SIMATIC IPC BX-39A Industrial Edge Device (Siemens) Fixed in V3.0
  • Fix · CNA SIMATIC IPC BX-59A Industrial Edge Device (Siemens) Fixed in V3.0
  • Fix · CNA SIMATIC IPC127E Industrial Edge Device (Siemens) Fixed in V3.0
  • Fix · CNA SIMATIC IPC227E Industrial Edge Device (Siemens) Fixed in V3.0
  • Fix · CNA SIMATIC IPC427E Industrial Edge Device (Siemens) Fixed in V3.0
  • Fix · CNA SIMATIC IPC847E Industrial Edge Device (Siemens) Fixed in V3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-54092
  2. 2026-10-03 Alias added: GHSA-66rj-6jjf-mmhq

References

Other 2

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences