Read the docs
TI-2026-26250 Aliases CVE-2026-33892GHSA-24c7-prh7-m3g7

Authentication bypass in Siemens Industrial Edge Management Pro V1

Priority LOW 23CWE-305Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >= V2.0.0 < V2.1.1), Industrial Edge Management Virtual (All versions >= V2.2.0 < V2.8.0). Affected management systems do not properly enforce user authentication on remote connections to devices. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device. Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00209 11th percentileScored 2026-11-07
Fix Fixed Industrial Edge Management Pro V1 (Siemens): V1.15.17Industrial Edge Management Pro V2 (Siemens): V2.1.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensIndustrial Edge Management Pro V1V1.7.6 to before V1.15.17V1.15.17Patch availableCNA
SiemensIndustrial Edge Management Pro V2V2.0.0 to before V2.1.1V2.1.1Patch availableCNA
SiemensIndustrial Edge Management VirtualV2.2.0 to before V2.8.0V2.8.0Patch availableCNA
  • Industrial Edge Management Pro V1 VendorSiemens Affected V1.7.6 to before V1.15.17 Fixed in V1.15.17 Patch available CNA
  • Industrial Edge Management Pro V2 VendorSiemens Affected V2.0.0 to before V2.1.1 Fixed in V2.1.1 Patch available CNA
  • Industrial Edge Management Virtual VendorSiemens Affected V2.2.0 to before V2.8.0 Fixed in V2.8.0 Patch available CNA

Remediation

  • Fix · CNA Industrial Edge Management Pro V1 (Siemens) Fixed in V1.15.17
  • Fix · CNA Industrial Edge Management Pro V2 (Siemens) Fixed in V2.1.1
  • Fix · CNA Industrial Edge Management Virtual (Siemens) Fixed in V2.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33892
  2. 2026-10-03 Alias added: GHSA-24c7-prh7-m3g7

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences