by Kastro
Paper/Archive/CVE-2026-44415

CVE-2026-44415

Siemens Industrial Edge Device Kit - arm64 V1.10 — Affected systems do not properly restrict access to internal APIs and paths for authenticated users.

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 41.1.411 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

Affected

ProductAffectedFixed inSource
Industrial Edge Device Kit - arm64 V1.10all versions–CNA
Industrial Edge Device Kit - arm64 V1.11all versions–CNA
Industrial Edge Device Kit - arm64 V1.12all versions–CNA
Industrial Edge Device Kit - arm64 V1.13all versions–CNA
Industrial Edge Device Kit - arm64 V1.14all versions–CNA
Industrial Edge Device Kit - arm64 V1.15all versions–CNA
Industrial Edge Device Kit - arm64 V1.16all versions–CNA
Industrial Edge Device Kit - arm64 V1.17all versions–CNA
Industrial Edge Device Kit - arm64 V1.18all versions–CNA
Industrial Edge Device Kit - arm64 V1.19all versions–CNA
Industrial Edge Device Kit - arm64 V1.20all versions–CNA
Industrial Edge Device Kit - arm64 V1.21all versions–CNA

Scores by source

siemens (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
siemens (CNA)8.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcert-portal.siemens.com/productcert/html/ssa-377139.htmlrefcert-portal.siemens.com/productcert/html/ssa-832641.html