Siemens Industrial Edge Devices
Plan PatchCVSS 9.1ICS-CERT ICSA-26-295-17Oct 13, 2026
SiemensManufacturing
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary
Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access sensitive internal information. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.
What this means
What could happen
Could allow full system compromise: read data, modify settings, and disrupt operations
Who's at risk
Organizations in manufacturing using Siemens equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device with privileged credentials. The attack is straightforward with no special conditions
Exploitability
Unlikely to be exploited - EPSS score 0.5%
Affected products (65)
13 with fix52 pending
Remediation & Mitigation
0/4
Do now - compensating controls
0/1WORKAROUNDEnsure network access to affected products is limited to trusted parties only
Schedule - requires maintenance window
0/3Patching may require device reboot, plan for process interruption
UPGRADEUpdate to V1.28.1 or later version
UPGRADEUpdate to V1.28.1-2 or later version
UPGRADEUpdate to V3.2.0-17 or later version
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/c0c27d68-c6e4-445e-b627-3532392f11fdGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.