Siemens Industrial Edge Management
Strategische Zusammenfassung
This CVE affects Siemens Industrial Edge Management, a platform used to manage edge devices in industrial environments, which could allow an attacker to compromise industrial operations.
Relevanz für dich
This CVE affects Siemens Industrial Edge Management, a platform used to manage edge devices in industrial environments, which could allow an attacker to compromise industrial operations.
Volltext
An official website of the United States government
Here’s how you know
Here’s how you know
**Official websites use .gov**
A **.gov** website belongs to an official government organization in the United States.
**Secure .gov websites use HTTPS**
A **lock** () or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
**Due to the lapse in federal funding, this website will not be actively managed.****Read More**
[×](javascript:void(0) "Clear search box")
[×](javascript:void(0) "Clear search box")
**Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens has released new versions for the affected products and recommends to update to the latest versions.**
| CVSS Version | Base Score | Base Severity | Vector String | | --- | --- | --- | --- | | **CVSS Version**3.1 | **Base Score**7.1 | **Base Severity**HIGH | **Vector String**CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
| CVSS | Vendor | Equipment | Vulnerabilities | | --- | --- | --- | --- | | **CVSS**v3 7.1 | **Vendor**Siemens | **Equipment**Siemens Industrial Edge Management | **Vulnerabilities**Authentication Bypass by Primary Weakness |
Affected management systems do not properly enforce user authentication on remote connections to devices. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device. Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper,
This ICSA is a verbati
ICS Advisory | ICSA-26-111-12
CISA Central[1-844-Say-CISA](tel:1-844-Say-CISA)[[email protected]](mailto:[email protected])
An official website of the U.S. Department of Homeland Security
Erwähnte CVEs
Risk Score
- cvss base
- 31.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 46.00
- industry weight
- 1.56
- freshness factor
- 1.00
- days old
- 2.00
Pfad: operational
MITRE ATT&CK Mapping
4 TTPsProcedure-Details
| Technik | Tactic | Procedure | Conf. | Quelle |
|---|---|---|---|---|
| T1556 Modify Authentication Process | Credential Access | CVE-2026-33892 allows an unauthenticated remote attacker to bypass authentication in Siemens Industrial Edge Management by exploiting improper enforcement of user authentication on remote connections, circumventing the primary authentication mechanism entirely. | high | llm |
| T1078 Valid Accounts | Defense Evasion | After bypassing authentication, the attacker can impersonate a legitimate user to access connected Industrial Edge Devices through the remote connection feature, effectively acting as an authorized user. | high | llm |
| T1572 Protocol Tunneling | Command and Control | Successful exploitation of CVE-2026-33892 allows the attacker to tunnel to connected Industrial Edge Devices via the management platform's remote connection feature after identifying the specific header and port used for remote connections. | high | llm |
| T1133 External Remote Services | Initial Access | The vulnerability is exploited remotely over the network by targeting the Industrial Edge Management remote connection feature, which serves as an external-facing remote access service for managing Industrial Edge Devices. | medium | llm |