CVE-2026-33892
highpriority · track · 0EPSS 0.002 · 11 %ileDEEUNLUSEPSS · scored 2026-10-27
A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >= V2.0.0 < V2.1.1), Industrial Edge Management Virtual (All versions >= V2.2.0 < V2.8.0). Affected management systems do not properly enforce user authentication on remote connections to devices. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device. Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedIndustrial Edge Management Pro V1siemens_psirt
Update to V1.15.17 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Pro V2siemens_psirt
Update to V2.1.1 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Virtualsiemens_psirt
Update to V2.8.0 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Pro V1cisa_csaf_ot
Update to V1.15.17 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Pro V2cisa_csaf_ot
Update to V2.1.1 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedIndustrial Edge Management Virtualcisa_csaf_ot
Update to V2.8.0 or later version
https://iehub.eu1.edge.siemens.cloud/ - MitigationIndustrial Edge Management Pro V1siemens_psirt
Ensure network access to affected products is limited to trusted parties only
- MitigationIndustrial Edge Management Pro V2siemens_psirt
Ensure network access to affected products is limited to trusted parties only
- MitigationIndustrial Edge Management Virtualsiemens_psirt
Ensure network access to affected products is limited to trusted parties only
- MitigationIndustrial Edge Management Pro V1cisa_csaf_ot
Ensure network access to affected products is limited to trusted parties only
- MitigationIndustrial Edge Management Pro V2cisa_csaf_ot
Ensure network access to affected products is limited to trusted parties only
- MitigationIndustrial Edge Management Virtualcisa_csaf_ot
Ensure network access to affected products is limited to trusted parties only
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 1.2–7.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (95)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0112Kwetsbaarheden verholpen in Siemens productenNL2026-04-14csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Analytics Toolkit, Ruggedcom, Industrial Edge Management Pro, SIDIS en TPM.
- SSA-609469SSA-609469: Authorization Bypass Vulnerability in Industrial Edge Management2026-04-14csaf · siemens_psirtDE
Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- WID-SEC-W-2026-1090Siemens Industrial Edge Management: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-04-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Siemens Industrial Edge Management ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- ICSA-26-111-11Siemens Industrial Edge Management2026-04-14icsa · cisa_csaf_otUS
Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens has released new versions for the affected products and recommends to update to the latest versions.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan