CVE-2024-54092 A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device…
Description
A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Industrial Edge Device Kit - arm64 V1.17 | Versions not published | |
| Industrial Edge Device Kit - arm64 V1.18 | Versions not published | |
| Industrial Edge Device Kit - arm64 V1.19 | Versions not published | |
| Industrial Edge Device Kit - arm64 V1.20 1.20 | earliest → < 1.20.2-1 | 1.20.2-1 |
| Industrial Edge Device Kit - arm64 V1.21 1.21 | earliest → < 1.21.1-1 | 1.21.1-1 |
| Industrial Edge Device Kit - x86-64 V1.17 | Versions not published | |
| Industrial Edge Device Kit - x86-64 V1.18 | Versions not published | |
| Industrial Edge Device Kit - x86-64 V1.19 | Versions not published | |
| Industrial Edge Device Kit - x86-64 V1.20 1.20 | earliest → < 1.20.2-1 | 1.20.2-1 |
Show the 10 other branches Hide the 10 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Industrial Edge Device Kit - x86-64 V1.21 1.21 | earliest → < 1.21.1-1 | 1.21.1-1 |
| Industrial Edge Own Device (IEOD) 1.21 | earliest → < 1.21.1-1-a | 1.21.1-1-a |
| Industrial Edge Virtual Device 1.21 | earliest → < 1.21.1-1-a | 1.21.1-1-a |
| SCALANCE LPE9413 2.1 | earliest → < 2.1 | 2.1 |
| SIMATIC IPC BX-39A Industrial Edge Device 3.0 | earliest → < 3.0 | 3.0 |
| SIMATIC IPC BX-59A Industrial Edge Device 3.0 | earliest → < 3.0 | 3.0 |
| SIMATIC IPC127E Industrial Edge Device 3.0 | earliest → < 3.0 | 3.0 |
| SIMATIC IPC227E Industrial Edge Device 3.0 | earliest → < 3.0 | 3.0 |
| SIMATIC IPC427E Industrial Edge Device 3.0 | earliest → < 3.0 | 3.0 |
| SIMATIC IPC847E Industrial Edge Device 3.0 | earliest → < 3.0 | 3.0 |
References
- cert-portal.siemens.com cert-portal.siemens.com
- cert-portal.siemens.com cert-portal.siemens.com
Timeline
- Published
- Last modified