Cyber Security News

Siemens Industrial Edge Management Vulnerable to Authorization Bypass Attacks

Siemens ProductCERT has disclosed a critical vulnerability in its Industrial Edge Management systems.

The vulnerability, identified as CVE-2024-45032, poses a significant risk by allowing unauthenticated remote attackers to impersonate other devices within the system.

This flaw has been rated with a maximum CVSS score of 10.0, indicating its severe potential impact.

CVE Details

The vulnerability stems from improper validation of device tokens, which could be exploited by attackers to bypass authorization mechanisms.

This flaw affects multiple versions of Siemens’ Industrial Edge Management products, including both the Pro and Virtual versions. Siemens has urged users to update to the latest versions to mitigate the risk.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14 day free trial

Vulnerability Table

Affected ProductVersions AffectedCVE IDRemediation
Industrial Edge Management ProAll versions < V1.9.5CVE-2024-45032Update to V1.9.5 or later
Industrial Edge Management VirtualAll versions < V2.3.1-1CVE-2024-45032Update to V2.3.1-1 or later

The Siemens advisory emphasizes the critical nature of this vulnerability, urging immediate action from users to secure their systems.

The flaw allows attackers to impersonate devices, potentially leading to unauthorized access and control over the industrial edge network.

Siemens has released updated versions of the affected products and guided users to secure their environments.

Remediation and Recommendations

Additionally, Siemens advises following general security practices, such as protecting network access with appropriate mechanisms and configuring IT environments according to their operational guidelines for industrial security.

To further protect against such vulnerabilities, Siemens suggests operating devices within a protected IT environment and adhering to their comprehensive security guidelines.

More information on industrial security practices can be found on Siemens’ official website.

The disclosure of CVE-2024-45032 highlights the ongoing challenges in securing industrial systems against sophisticated cyber threats.

Siemens’ prompt response and detailed advisory underscore the importance of timely updates and adherence to security best practices to safeguard critical infrastructure.

What Does MITRE ATT&CK Expose About Your Enterprise Security? - Watch Free Webinar!

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as "GruesomeLarch"…

1 day ago

240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft

Microsoft's Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by Egypt-based…

2 days ago

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in Central…

2 days ago

Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations

Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to India,…

2 days ago

Raspberry Robin Employs TOR Network For C2 Servers Communication

Raspberry Robin, a stealthy malware discovered in 2021, leverages advanced obfuscation techniques to evade detection…

2 days ago

145,000 ICS Systems, Thousands of HMIs Exposed to Cyber Attacks

Critical infrastructure, the lifeblood of modern society, is under increasing threat as a new report…

2 days ago