VDB
ICSA-26-015-09
ICSA-26-015-09
PUBLISHED
CVSS 10 CRITICAL
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains an authorization bypass vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Risk Scores
CVSS v3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Industrial Edge Device Kit - arm64 V1.11 | ||
| Industrial Edge Device Kit - arm64 V1.21 | ||
| Industrial Edge Device Kit - arm64 V1.18 | ||
| Industrial Edge Device Kit - arm64 V1.16 | ||
| Industrial Edge Device Kit - arm64 V1.20 | ||
| Industrial Edge Device Kit - arm64 V1.19 | ||
| Industrial Edge Device Kit - arm64 V1.14 | ||
| Industrial Edge Device Kit - arm64 V1.5 | ||
| Industrial Edge Device Kit - arm64 V1.6 | ||
| Industrial Edge Device Kit - arm64 V1.25 | ||
| Industrial Edge Device Kit - arm64 V1.12 | ||
| Industrial Edge Device Kit - arm64 V1.8 | ||
| Industrial Edge Device Kit - arm64 V1.15 | ||
| Industrial Edge Device Kit - arm64 V1.24 | ||
| Industrial Edge Device Kit - arm64 V1.23 | ||
| Industrial Edge Device Kit - arm64 V1.7 | ||
| Industrial Edge Device Kit - arm64 V1.13 | ||
| Industrial Edge Device Kit - arm64 V1.22 | ||
| Industrial Edge Device Kit - arm64 V1.17 | ||
| Industrial Edge Device Kit - arm64 V1.10 |
Timeline
- Jan 13, 2026 CVE Published
- Jan 14, 2026 CVE Updated
References
- https://cert-portal.siemens.com/productcert/csaf/ssa-014678.json advisory
- https://cert-portal.siemens.com/productcert/html/ssa-014678.html advisory
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-015-09.json advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-09 advisory
- https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01 url
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices url
- https://www.cisa.gov/topics/industrial-control-systems url
- https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf url
- https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf url
- https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b url