SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management
Industrial Edge Management contains a vulnerability that could allow an unauthenticated attacker to spoof a trusted entity by interfering in the communication path between the Industrial Edge Management (IEM) and the Industrial Edge Hub (IEH) using a crafted certificate. An attacker could use this to inject malicious maintenance requests (e.g. sending statistics, activating remote support, exchanging the initial keys when onboarding, querying new extensions). Siemens has released an update for the Industrial Edge Management and recommends to update to the latest version.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-40147US | high7.4 | — | ||
A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate the server certificate when initiating a… | ||||
references
External citations — patches, advisories, analysis.
- SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management - CSAF Versionself
- SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management - PDF Versionself
- SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management - TXT Versionself
remediations (1)
- FixedIndustrial Edge Management
Update to V1.5.1 or later version
https://iehub.eu1.edge.siemens.cloud/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan