SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management
Industrial Edge Management contains a vulnerability that could allow an unauthenticated attacker to spoof a trusted entity by interfering in the communication path between the Industrial Edge Management (IEM) and the Industrial Edge Hub (IEH) using a crafted certificate. An attacker could use this to inject malicious maintenance requests (e.g. sending statistics, activating remote support, exchanging the initial keys when onboarding, querying new extensions). Siemens has released an update for the Industrial Edge Management and recommends to update to the latest version.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-40147US | high7.4 | — | ||
A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate the server certificate when initiating a… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management - CSAF Versionself
- SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management - PDF Versionself
- SSA-649853: Improper Certificate Validation Vulnerability in Industrial Edge Management - TXT Versionself
Behebungen (1)
- BehobenIndustrial Edge Management
Update to V1.5.1 or later version
https://iehub.eu1.edge.siemens.cloud/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan