OTPulse

Siemens Industrial Edge Device Kit

Plan PatchCVSS 9.1ICS-CERT ICSA-26-295-09Oct 13, 2026
SiemensManufacturing
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary

Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

What this means
What could happen
Could allow full system compromise — read data, modify settings, and disrupt operations
Who's at risk
Organizations in manufacturing using Siemens equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device with privileged credentials. The attack is straightforward with no special conditions
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (48)
6 with fix42 EOL
ProductAffected VersionsFix Status
Industrial Edge Device Kit - arm64 V1.10All versionsNo fix (EOL)
Industrial Edge Device Kit - arm64 V1.19All versionsNo fix (EOL)
Industrial Edge Device Kit - arm64 V1.20All versionsNo fix (EOL)
Industrial Edge Device Kit - arm64 V1.21All versionsNo fix (EOL)
Industrial Edge Device Kit - arm64 V1.22All versionsNo fix (EOL)
Remediation & Mitigation
0/5
Do now — compensating controls
0/1
WORKAROUNDEnsure network access to affected products is limited to trusted parties only
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

UPGRADEUpdate to V1.26.2-1 or later version
UPGRADEUpdate to V1.27.1-1 or later version
UPGRADEUpdate to V1.28.0-6 or later version
Mitigations - no patch available
0/1
The following products have reached End of Life with no planned fix: Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.19, Industrial Edge Device Kit - arm64 V1.20, Industrial Edge Device Kit - arm64 V1.21, Industrial Edge Device Kit - arm64 V1.22, Industrial Edge Device Kit - arm64 V1.23, Industrial Edge Device Kit - arm64 V1.24, Industrial Edge Device Kit - arm64 V1.25, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.5, Industrial Edge Device Kit - arm64 V1.6, Industrial Edge Device Kit - arm64 V1.7, Industrial Edge Device Kit - arm64 V1.8, Industrial Edge Device Kit - arm64 V1.9, Industrial Edge Device Kit - x86-64 V1.10, Industrial Edge Device Kit - x86-64 V1.11, Industrial Edge Device Kit - x86-64 V1.12, Industrial Edge Device Kit - x86-64 V1.13, Industrial Edge Device Kit - x86-64 V1.14, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - x86-64 V1.15, Industrial Edge Device Kit - x86-64 V1.16, Industrial Edge Device Kit - x86-64 V1.17, Industrial Edge Device Kit - x86-64 V1.18, Industrial Edge Device Kit - x86-64 V1.19, Industrial Edge Device Kit - x86-64 V1.20, Industrial Edge Device Kit - x86-64 V1.21, Industrial Edge Device Kit - x86-64 V1.22, Industrial Edge Device Kit - x86-64 V1.23, Industrial Edge Device Kit - x86-64 V1.24, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - x86-64 V1.25, Industrial Edge Device Kit - x86-64 V1.5, Industrial Edge Device Kit - x86-64 V1.6, Industrial Edge Device Kit - x86-64 V1.7, Industrial Edge Device Kit - x86-64 V1.8, Industrial Edge Device Kit - x86-64 V1.9, Industrial Edge Device Kit - arm64 V1.14, Industrial Edge Device Kit - arm64 V1.15, Industrial Edge Device Kit - arm64 V1.16, Industrial Edge Device Kit - arm64 V1.17, Industrial Edge Device Kit - arm64 V1.18. Apply the following compensating controls:
HARDENINGCurrently no fix is planned
View full CISA ICS-CERT advisory
API: /api/v1/advisories/d085b868-d758-401a-9f00-1bc1e1b05a54

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.