CVE-2024-54092

The vulnerability results from improper enforcement of user authentication at specific API endpoints when identity federation mechanism is configured. An attacker who knows the identity of a legitimate user can send specially crafted requests to these unprotected endpoints and bypass required authentication. A necessary condition for carrying out the attack is that identity federation is currently active or was previously used on the device, and the attacker possesses information about the identity of at least one legitimate user.

A successful attack allows an unauthenticated remote attacker to impersonate a legitimate system user, which may lead to unauthorized access to data, industrial device configuration, and potentially compromise the integrity and availability of the Industrial Edge environment.

Software must be updated to versions that eliminate the vulnerability: Industrial Edge Device Kit V1.20 to V1.20.2-1 or later, V1.21 to V1.21.1-1 or later; Industrial Edge Own Device (IEOD) and Industrial Edge Virtual Device to V1.21.1-1-a or later; SCALANCE LPE9413 to V2.1 or later; SIMATIC IPC BX-39A, BX-59A, IPC127E, IPC227E, IPC427E, IPC847E to V3.0 or later. For versions V1.17, V1.18, and V1.19, no patched versions are indicated — consult with the manufacturer and review Siemens ProductCERT advisories: SSA-634640 and SSA-819629. As a temporary measure, consider disabling identity federation functionality where it is not essential.

Industrial Edge Device Kit (arm64 and x86-64) in versions V1.17, V1.18, V1.19 (all versions) and V1.20 (below V1.20.2-1) and V1.21 (below V1.21.1-1); Industrial Edge Own Device (IEOD) below V1.21.1-1-a; Industrial Edge Virtual Device below V1.21.1-1-a; SCALANCE LPE9413 (6GK5998-3GS01-2AC2) below V2.1; SIMATIC IPC BX-39A, BX-59A, IPC127E, IPC227E, IPC427E, IPC847E Industrial Edge Device — all versions below V3.0