Siemens Industrial Edge Device Kit
Plan PatchCVSS 9.8ICS-CERT ICSA-25-105-02Apr 8, 2025
SiemensManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Industrial Edge Device Kit contains a weak authentication vulnerability that could allow an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. The vulnerability affects multiple versions of the Industrial Edge Device Kit across both arm64 and x86-64 architectures, as well as Industrial Edge-based devices including SIMATIC IPC and SCALANCE LPE devices.
What this means
What could happen
An attacker could bypass authentication to gain access to an Industrial Edge Device, potentially allowing them to modify edge computing configurations, access process data, or interfere with distributed automation tasks running on the edge infrastructure.
Who's at risk
Manufacturing organizations using Siemens Industrial Edge devices should prioritize this vulnerability. Affected equipment includes Industrial Edge Own Devices, Industrial Edge Virtual Devices, SIMATIC IPC Industrial Edge Devices (IPC127E, IPC227E, IPC427E, IPC847E, IPC BX-39A, BX-59A), SCALANCE LPE9413 switches, and any custom edge devices built on the vulnerable Industrial Edge Device Kit. Organizations running V1.17, V1.18, or V1.19 versions of the Industrial Edge Device Kit on arm64 or x86-64 platforms cannot apply vendor patches and must rely on network-level protections.
How it could be exploited
An attacker with network access to an affected Industrial Edge Device can send specially crafted authentication requests to circumvent the weak authentication mechanism without providing valid credentials. Once authenticated, the attacker can interact with the device as a legitimate user to access or modify configurations and data.
Prerequisites
- Network access to the Industrial Edge Device management interface
- No valid user credentials required
remotely exploitableno authentication requiredlow complexitycritical CVSS score (9.8)affects multiple product variants with no patches available for older versions
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (19)
13 with fix6 EOL
ProductAffected VersionsFix Status
Industrial Edge Own Device (IEOD)All versions < V1.21.1-1-a1.21.1-1-a
Industrial Edge Virtual DeviceAll versions < V1.21.1-1-a1.21.1-1-a
SCALANCE LPE9413< V2.12.1
SIMATIC IPC127E Industrial Edge Device< V3.03.0
SIMATIC IPC227E Industrial Edge Device< V3.03.0
Remediation & Mitigation
0/8
Do now
0/1WORKAROUNDRestrict network access to Industrial Edge Device management interfaces to trusted parties only, using firewall rules or network segmentation
Schedule — requires maintenance window
0/6Patching may require device reboot — plan for process interruption
SCALANCE LPE9413
HOTFIXUpdate SCALANCE LPE9413 to version 2.1 or later
All products
HOTFIXUpdate Industrial Edge Device Kit arm64 V1.20 to version 1.20.2-1 or later
HOTFIXUpdate Industrial Edge Device Kit x86-64 V1.20 to version 1.20.2-1 or later
HOTFIXUpdate Industrial Edge Device Kit arm64 V1.21 to version 1.21.1-1 or later
HOTFIXUpdate Industrial Edge Device Kit x86-64 V1.21 to version 1.21.1-1 or later
HOTFIXUpdate SIMATIC IPC127E, IPC227E, IPC427E, IPC847E, IPC BX-39A, and IPC BX-59A Industrial Edge Devices to version 3.0 or later
Mitigations - no patch available
0/1The following products have reached End of Life with no planned fix: Industrial Edge Device Kit - arm64 V1.18, Industrial Edge Device Kit - x86-64 V1.19, Industrial Edge Device Kit - arm64 V1.17, Industrial Edge Device Kit - arm64 V1.19, Industrial Edge Device Kit - x86-64 V1.17, Industrial Edge Device Kit - x86-64 V1.18. Apply the following compensating controls:
HARDENINGIsolate Industrial Edge Devices from the business network and internet using network segmentation or firewalls
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/89d6ff2f-f3f5-41c2-851c-cebcdb27f8f4Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.