OTPulse

Siemens Industrial Edge Management

Plan PatchCVSS 9.1ICS-CERT ICSA-26-265-06Sep 8, 2026
SiemensManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Industrial Edge Management contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to reset any user's password without email verification, enabling full account takeover. The vulnerability exists in the password reset endpoint and affects Industrial Edge Management Cloud (all versions), Pro V1 (versions 1.14.9 to 1.15.19), Pro V2 (versions 2.2.0 to 2.2.1), and Virtual (versions 2.6.0 to 2.9.0). Siemens has released patches for all affected product lines.

What this means
What could happen
An attacker without credentials can reset any user's password and gain full account access to your Industrial Edge Management system, potentially allowing them to modify device configurations, access sensitive data, or disrupt manufacturing operations.
Who's at risk
Manufacturing facilities running Siemens Industrial Edge Management (Pro or Virtual versions) for edge computing and device management. This affects any organization that exposes IEM to the internet or untrusted networks for remote administration or cloud connectivity.
How it could be exploited
An attacker sends a credential reset request to the affected endpoint (/auth/realms/customer/login-actions/reset-credentials) without authentication. The system bypasses email verification and generates a password reset token that can be used to change the target user's credentials, granting full account access to the platform.
Prerequisites
  • Network access to the Industrial Edge Management system on the internet or reachable network
  • No authentication credentials required
  • Password reset feature enabled in Keycloak realm settings
remotely exploitableno authentication requiredlow complexityhigh CVSS score (9.1)
Exploitability
Some exploitation risk — EPSS score 6.4%
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
Industrial Edge Management CloudAll versionsFix available
Industrial Edge Management Pro V1 >= V1.14.9 < V1.15.20≥ 1.14.9, < 1.15.201.15.20
Industrial Edge Management Pro V2 >= V2.2.0 < V2.2.2≥ 2.2.0, < 2.2.22.2.2
Industrial Edge Management Virtual >= V2.6.0 < V2.9.1≥ 2.6.0, < 2.9.12.9.1
Remediation & Mitigation
0/4
Do now
0/3
WORKAROUNDBlock direct internet access to your Industrial Edge Management Pro or Virtual instance at the firewall or network boundary
WORKAROUNDConfigure a Web Application Firewall (WAF) or Reverse Proxy to block the path /auth/realms/customer/login-actions/reset-credentials
HARDENINGDisable password reset functionality in Keycloak realm settings: Identity & access management > realm settings > Login > Forgot password > Off
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Industrial Edge Management Pro to version 1.15.20 or later, and Industrial Edge Management Virtual to version 2.9.1 or later
View full CISA ICS-CERT advisory
API: /api/v1/advisories/e5d70562-9952-42ef-b22c-e3b45f0c5a97

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.