CVE-2024-54092 
A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.
Problem types: cwe_id: CWE-1390
description: CWE-1390: Weak Authentication
Affected products: vendor: Siemens
product: Industrial Edge Device Kit - arm64 V1.17
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - arm64 V1.18
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - arm64 V1.19
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - arm64 V1.20
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - arm64 V1.21
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - x86-64 V1.17
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - x86-64 V1.18
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - x86-64 V1.19
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - x86-64 V1.20
default_status: unknown
vendor: Siemens
product: Industrial Edge Device Kit - x86-64 V1.21
default_status: unknown
vendor: Siemens
product: Industrial Edge Own Device (IEOD)
default_status: unknown
vendor: Siemens
product: Industrial Edge Virtual Device
default_status: unknown
vendor: Siemens
product: SCALANCE LPE9413
default_status: unknown
vendor: Siemens
product: SIMATIC IPC BX-39A Industrial Edge Device
default_status: unknown
vendor: Siemens
product: SIMATIC IPC BX-59A Industrial Edge Device
default_status: unknown
vendor: Siemens
product: SIMATIC IPC127E Industrial Edge Device
default_status: unknown
vendor: Siemens
product: SIMATIC IPC227E Industrial Edge Device
default_status: unknown
vendor: Siemens
product: SIMATIC IPC427E Industrial Edge Device
default_status: unknown
vendor: Siemens
product: SIMATIC IPC847E Industrial Edge Device
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2025-04-08T08:22:24.861Z