Paper/Archive/CVE-2024-45032

CVE-2024-45032

Siemens Industrial Edge Management Pro — A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All ve…

EPSS 0.8%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 55.4.554 × 2011.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1). Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices onboarded to the system.

Affected

ProductAffectedFixed inSource

Industrial Edge Management Pro< V1.9.5V1.9.5CNA

Industrial Edge Management Virtual< V2.3.1-1V2.3.1-1CNA

industrial_edge_management_pro< 1.9.51.9.5CISA-ADP

industrial_edge_management_virtual< 2.3.1-12.3.1-1CISA-ADP

Scores by source

siemens (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

siemens (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert-portal.siemens.com/productcert/html/ssa-359713.html