Siemens Industrial Edge Management
Successful exploitation of this vulnerability could allow an attacker to inject malicious maintenance requests by exploiting improper certification validation. An attacker could exploit this vulnerability by sending statistics, activating remote support, exchanging the initial keys when onboarding, querying new extensions, or accessing sensitive data.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-40147US | high7.4 | — | ||
A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate the server certificate when initiating a… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-22-286-02 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (1)
- FixedIndustrial Edge Management
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens ' operational guidelines for industrial security and to follow the recommendations in the product manuals.
https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan