Siemens HyperLynx and Industrial Edge App Publisher
Multiple Siemens products are affected by a type confusion vulnerability in Google Chrome prior to 138.0.7204.96. This could allow a remote attacker to perform arbitrary code execution via a crafted HTML page. Siemens has released a new version for Industrial Edge App Publisher and recommends to update to the latest version. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-6554US | —OT critical | KEV | ||
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) | ||||
references
External citations — patches, advisories, analysis.
- SSA-365200: Google Chrome Type Confusion Vulnerability in Siemens Products - CSAF Versionself
- SSA-365200: Google Chrome Type Confusion Vulnerability in Siemens Products - HTML Versionself
- ICS Advisory ICSA-25-289-10 JSONself
- ICS Advisory ICSA-25-289-10 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (2)
- FixedHyperLynx
Update to V2510.0001 or later version
https://support.sw.siemens.com/product/861057060 - FixedIndustrial Edge App Publisher
Update to V1.23.5 or later version
https://docs.eu1.edge.siemens.cloud/develop_an_application/ieap/download_the_ie_ap.html
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan