View CSAF Summary The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration.
Siemens Industrial Edge App Publisher
About this summary. This is a short excerpt from the description that CISA published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-02
Source attribution: headline and facts are from CISA (cisa.gov). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Siemens SIMATIC S7 Webserver API
View CSAF Summary .NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or…
Siemens Capital Embedded AR Classic
View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or…
Siemens PSS(R)SINCAL
View CSAF Summary PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause…
Siemens Software Center
View CSAF Summary The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to…
Siemens SIMATIC IPCs
View CSAF Summary The products listed below contain a vulnerability that could allow an attacker to boot an operating system or UEFI application signed with that test…
Siemens SENTRON 3NA COM Fuse
View CSAF Summary SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a…