Improper Integrity Check of Firmware Updates in Building X - Security Manager Edge Controller (ACC-AP)
Monitor6.2SSA-420375Dec 9, 2025
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Building X - Security Manager Edge Controller (ACC-AP) devices do not properly verify the integrity of firmware updates. An attacker could upload a maliciously modified firmware image to the device, compromising its security functions. Siemens is preparing fix versions and recommends implementing network access controls and security best practices in the interim.
What this means
What could happen
An attacker could upload maliciously modified firmware to the Building X Security Manager Edge Controller, potentially compromising the device's ability to control building security systems and allowing unauthorized access to or manipulation of security functions.
Who's at risk
Building security operations staff and IT personnel managing Siemens Building X Security Manager Edge Controller (ACC-AP) devices should be concerned. This affects any facility using ACC-AP controllers for access control, monitoring, or security management functions.
How it could be exploited
An attacker with local access to the device or network access to the firmware upload mechanism could bypass the integrity check and install modified firmware without detection. The modified firmware could then perform unauthorized actions such as disabling security controls or granting unauthorized access.
Prerequisites
- Local or network access to the device's firmware update interface
- Ability to provide a modified firmware image to the device
no patch availableaffects safety/security systemsallows unauthorized firmware modification
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
Building X - Security Manager Edge Controller (ACC-AP)All versionsNo fix (EOL)
Remediation & Mitigation
0/4
Do now
0/2HARDENINGRestrict network access to the ACC-AP firmware update interface using firewall rules and network segmentation. Limit access to authorized engineering workstations only.
HARDENINGImplement physical security controls to prevent unauthorized local access to the device for maintenance or update operations.
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
WORKAROUNDMonitor firmware update logs and verify integrity of installed firmware through out-of-band verification methods if available.
HOTFIXApply vendor patch when available from Siemens for all ACC-AP devices.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/f56084bd-1043-4822-bedd-c760973a4089