CVE-2024-54092
published 2025-04-08CVE-2024-54092: A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions)…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.72%
49.1th percentile
A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | industrial_edge_device_kit_arm64_v1.17 | < * | * |
| siemens | industrial_edge_device_kit_arm64_v1.18 | < * | * |
| siemens | industrial_edge_device_kit_arm64_v1.19 | < * | * |
| siemens | industrial_edge_device_kit_arm64_v1.20 | < V1.20.2-1 | V1.20.2-1 |
| siemens | industrial_edge_device_kit_arm64_v1.21 | < V1.21.1-1 | V1.21.1-1 |
| siemens | industrial_edge_device_kit_x86-64_v1.17 | < * | * |
| siemens | industrial_edge_device_kit_x86-64_v1.18 | < * | * |
| siemens | industrial_edge_device_kit_x86-64_v1.19 | < * | * |
| siemens | industrial_edge_device_kit_x86-64_v1.20 | < V1.20.2-1 | V1.20.2-1 |
| siemens | industrial_edge_device_kit_x86-64_v1.21 | < V1.21.1-1 | V1.21.1-1 |
| siemens | industrial_edge_own_device | < V1.21.1-1-a | V1.21.1-1-a |
| siemens | industrial_edge_virtual_device | < V1.21.1-1-a | V1.21.1-1-a |
| siemens | scalance_lpe9413 | < V2.1 | V2.1 |
| siemens | simatic_ipc127e_industrial_edge_device | < V3.0 | V3.0 |
| siemens | simatic_ipc227e_industrial_edge_device | < V3.0 | V3.0 |
| siemens | simatic_ipc427e_industrial_edge_device | < V3.0 | V3.0 |
| siemens | simatic_ipc847e_industrial_edge_device | < V3.0 | V3.0 |
| siemens | simatic_ipc_bx-39a_industrial_edge_device | < V3.0 | V3.0 |
| siemens | simatic_ipc_bx-59a_industrial_edge_device | < V3.0 | V3.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability targets specific API endpoints that fail to enforce authentication when identity federation is configured or has previously been configured. Monitor for unauthenticated requests to API endpoints on affected Siemens Industrial Edge devices, particularly when identity federation is or was in use. ↗
- →Exploitation requires the attacker to know a valid username. Detect anomalous authentication events where a known username authenticates without a corresponding valid credential exchange, especially from external/untrusted network sources. ↗
- →The attack is network-based with no privileges required and no user interaction. Alert on unauthenticated remote access attempts to Industrial Edge device management APIs from untrusted network segments. ↗
- ·Exploitation is only possible if identity federation is currently active or has previously been enabled on the device. Devices that have never used identity federation are not exploitable. ↗
- ·Some affected product lines have no available fix (SCALANCE LPE9413, SIMATIC IPC427E, and Industrial Edge Device Kit V1.17–V1.19 for both arm64 and x86-64). Detection and network isolation are the only mitigations for these. ↗
- ·No known public exploitation has been reported at time of advisory publication, but the CVSS v3 score is 9.8 (Critical) and CVSS v4 is 9.3, indicating high severity if exploited. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens Industrial Edge Device Kit
cisa_ics·2025-04-15
Siemens Industrial Edge Device Kit
ICS Advisory
##
Siemens Industrial Edge Device Kit
Release DateApril 15, 2025
Alert CodeICSA-25-105-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Industrial Edge Device Kit
- Vulnerability: Weak Authentication
## 2. RISK EVALUATION
Successful exploitation of this vulne
CISA ICS
Siemens Industrial Edge Devices
cisa_ics·2025-04-10
Siemens Industrial Edge Devices
ICS Advisory
##
Siemens Industrial Edge Devices
Release DateApril 10, 2025
Alert CodeICSA-25-100-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Industrial Edge Devices
- Vulnerability: Weak Authentication
## 2. RISK EVALUATION
Successful exploitation of the vulnerabilit
GHSA
GHSA-66rj-6jjf-mmhq: A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1
ghsa_unreviewed·2025-04-08
CVE-2024-54092 [CRITICAL] CWE-1390 GHSA-66rj-6jjf-mmhq: A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1
A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-08
Published