CyberSecBulletin
CVE-2024-54092NVD status: Deferred

Industrial Edge Device Kit - arm64 V1.17: Weak Authentication

Published Updated By the CyberSecBulletin desk

CVE-2024-54092 is a critical-severity weak authentication vulnerability in Industrial Edge Device Kit - arm64 V1.17 from Siemens, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Industrial Edge Device Kit - arm64 V1.17 versions: all versions. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.77% chance of exploitation within 30 days, higher than 56% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Industrial Edge Device Kit - arm64 V1.20 to V1.20.2-1 or a later version.
  2. Update Industrial Edge Device Kit - arm64 V1.21 to V1.21.1-1 or a later version.
  3. Update Industrial Edge Device Kit - x86-64 V1.20 to V1.20.2-1 or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
SiemensIndustrial Edge Device Kit - arm64 V1.17all versionsNot stated
SiemensIndustrial Edge Device Kit - arm64 V1.18all versionsNot stated
SiemensIndustrial Edge Device Kit - arm64 V1.19all versionsNot stated
SiemensIndustrial Edge Device Kit - arm64 V1.20before V1.20.2-1V1.20.2-1
SiemensIndustrial Edge Device Kit - arm64 V1.21before V1.21.1-1V1.21.1-1
SiemensIndustrial Edge Device Kit - x86-64 V1.17all versionsNot stated
SiemensIndustrial Edge Device Kit - x86-64 V1.18all versionsNot stated
SiemensIndustrial Edge Device Kit - x86-64 V1.19all versionsNot stated
SiemensIndustrial Edge Device Kit - x86-64 V1.20before V1.20.2-1V1.20.2-1
SiemensIndustrial Edge Device Kit - x86-64 V1.21before V1.21.1-1V1.21.1-1
SiemensIndustrial Edge Own Device (IEOD)before V1.21.1-1-aV1.21.1-1-a
SiemensIndustrial Edge Virtual Devicebefore V1.21.1-1-aV1.21.1-1-a
SiemensSCALANCE LPE9413before V2.1V2.1
SiemensSIMATIC IPC BX-39A Industrial Edge Devicebefore V3.0V3.0
SiemensSIMATIC IPC BX-59A Industrial Edge Devicebefore V3.0V3.0
SiemensSIMATIC IPC127E Industrial Edge Devicebefore V3.0V3.0
SiemensSIMATIC IPC227E Industrial Edge Devicebefore V3.0V3.0
SiemensSIMATIC IPC427E Industrial Edge Devicebefore V3.0V3.0
SiemensSIMATIC IPC847E Industrial Edge Devicebefore V3.0V3.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (siemens.com).

Scoring systemScoreSeverityScored by
CVSS 4.09.3CriticalCNA (siemens.com)
CVSS 3.19.8CriticalCNA (siemens.com)

Official description

A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

More Weak Authentication vulnerabilities (CWE-1390)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Industrial Edge Device Kit - arm64 V1.17

All Industrial Edge Device Kit - arm64 V1.17 vulnerabilities

Recent Weak Authentication vulnerabilities

Spotted an error? Tell us.