N/A

A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >= V2.0.0 < V2.1.1), Industrial Edge Management Virtual (All versions >= V2.2.0 < V2.8.0). Affected management systems do not properly enforce user authentication on remote connections to devices. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device. Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

使用基本弱点进行的认证绕过

Siemens Industrial Edge Management 安全漏洞

Siemens Industrial Edge Management是德国西门子（Siemens）公司的一个平台，用于在靠近车间的计算平台上托管来自不同供应商的应用程序。 Siemens Industrial Edge Management存在安全漏洞，该漏洞源于远程连接设备时用户身份验证执行不当，可能导致未经身份验证的远程攻击者绕过身份验证并冒充合法用户。

N/A

N/A