Log in Start free

Vulnerability · Published Apr 8, 2025 · Assigned by siemens

CVE-2024-54092

Critical 9.8

In plain English

A critical-severity security flaw in Industrial Edge Device Kit - arm64 V1.17 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 44.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.

Affected products (as reported)

VendorProductVersions
Siemens Industrial Edge Device Kit - arm64 V1.17 0 – before *
Siemens Industrial Edge Device Kit - arm64 V1.18 0 – before *
Siemens Industrial Edge Device Kit - arm64 V1.19 0 – before *
Siemens Industrial Edge Device Kit - arm64 V1.20 0 – before V1.20.2-1
Siemens Industrial Edge Device Kit - arm64 V1.21 0 – before V1.21.1-1
Siemens Industrial Edge Device Kit - x86-64 V1.17 0 – before *
Siemens Industrial Edge Device Kit - x86-64 V1.18 0 – before *
Siemens Industrial Edge Device Kit - x86-64 V1.19 0 – before *
Siemens Industrial Edge Device Kit - x86-64 V1.20 0 – before V1.20.2-1
Siemens Industrial Edge Device Kit - x86-64 V1.21 0 – before V1.21.1-1
Siemens Industrial Edge Own Device (IEOD) 0 – before V1.21.1-1-a
Siemens Industrial Edge Virtual Device 0 – before V1.21.1-1-a
Siemens SCALANCE LPE9413 0 – before V2.1
Siemens SIMATIC IPC BX-39A Industrial Edge Device 0 – before V3.0
Siemens SIMATIC IPC BX-59A Industrial Edge Device 0 – before V3.0
Siemens SIMATIC IPC127E Industrial Edge Device 0 – before V3.0
Siemens SIMATIC IPC227E Industrial Edge Device 0 – before V3.0
Siemens SIMATIC IPC427E Industrial Edge Device 0 – before V3.0
Siemens SIMATIC IPC847E Industrial Edge Device 0 – before V3.0

Weakness: CWE-1390 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References