{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-609469: Authorization Bypass Vulnerability in Industrial Edge Management - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-609469.html"
      },
      {
        "category": "self",
        "summary": "SSA-609469: Authorization Bypass Vulnerability in Industrial Edge Management - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-609469.json"
      }
    ],
    "title": "SSA-609469: Authorization Bypass Vulnerability in Industrial Edge Management",
    "tracking": {
      "current_release_date": "2026-04-14T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-609469",
      "initial_release_date": "2026-04-14T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-04-14T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003e=1.7.6|\u003c1.15.17",
                "product": {
                  "name": "Industrial Edge Management Pro V1",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Management Pro V1"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003e=2.0.0|\u003c2.1.1",
                "product": {
                  "name": "Industrial Edge Management Pro V2",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Management Pro V2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003e=2.2.0|\u003c2.8.0",
                "product": {
                  "name": "Industrial Edge Management Virtual",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Management Virtual"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33892",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected management systems do not properly enforce user authentication on remote connections to devices.\r\nThis could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user.\r\nSuccessful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device.\r\n\r\nExploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Ensure network access to affected products is limited to trusted parties only",
          "product_ids": [
            "1",
            "2",
            "3"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.15.17 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://iehub.eu1.edge.siemens.cloud/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.1.1 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://iehub.eu1.edge.siemens.cloud/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.8.0 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://iehub.eu1.edge.siemens.cloud/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "title": "CVE-2026-33892"
    }
  ]
}