CyberSecBulletin
CVE-2026-33892NVD status: Awaiting Analysis

Industrial Edge Management Pro V1: Authentication Bypass by Primary Weakness

Published Updated By the CyberSecBulletin desk

CVE-2026-33892 is a high-severity authentication bypass by primary weakness vulnerability in Industrial Edge Management Pro V1 from Siemens, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists version V1.15.17 as the first without the flaw, so updating Industrial Edge Management Pro V1 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Industrial Edge Management Pro V1 to V1.15.17 or a later version.
  2. Update Industrial Edge Management Pro V2 to V2.1.1 or a later version.
  3. Update Industrial Edge Management Virtual to V2.8.0 or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
  5. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
SiemensIndustrial Edge Management Pro V1V1.7.6 up to, but not including, V1.15.17V1.15.17
SiemensIndustrial Edge Management Pro V2V2.0.0 up to, but not including, V2.1.1V2.1.1
SiemensIndustrial Edge Management VirtualV2.2.0 up to, but not including, V2.8.0V2.8.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
LowSome restricted data can be read.
Integrity
LowLimited modification of data is possible.
Availability
LowPerformance or availability is reduced.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Scored by CNA (siemens.com).

Scoring systemScoreSeverityScored by
CVSS 4.05.1MediumCNA (siemens.com)
CVSS 3.17.1HighCNA (siemens.com)

Official description

A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >= V2.0.0 < V2.1.1), Industrial Edge Management Virtual (All versions >= V2.2.0 < V2.8.0). Affected management systems do not properly enforce user authentication on remote connections to devices. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device. Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

More Authentication Bypass by Primary Weakness vulnerabilities (CWE-305)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Industrial Edge Management Pro V1

All Industrial Edge Management Pro V1 vulnerabilities

Recent Authentication Bypass by Primary Weakness vulnerabilities

Spotted an error? Tell us.