Siemens Industrial Edge App Publisher Certificate Validation & XSS Vulnerability Advisory

Vulnerability Overview The Siemens Security Advisory indicates that Industrial Edge App Publisher contains multiple vulnerabilities, including incorrect certificate validation and rendering of unescaped data from backend responses. These issues could allow an attacker to impersonate the management server on the network and execute arbitrary code (RCE). Scope of Impact Affected Product: Industrial Edge App Publisher Affected Versions: All versions < V1.27.9 Remediation Fixed Version: Update to V1.27.9 or later Download Link: https://ics.su1.edge.siemens.cloud/devien_app/application/new/download/the_ics_en.html Vulnerability Details Vulnerability CVE-2026-78556 Description: The software does not properly validate server certificates when establishing a TLS connection, allowing an attacker to intercept and replay communications via a man-in-the-middle attack. CVSS v3.1 Base Score: 7.4 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS v4.0 Base Score: 7.5 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/HI:H/NA:SC:N/NS:A:N CWE: CWE-295: Improper Certificate Validation Vulnerability CVE-2026-78557 Description: The application fails to properly sanitize or escape data received from the backend, potentially executing arbitrary JavaScript during frontend rendering, thereby enabling remote code execution (RCE). CVSS v3.1 Base Score: 8.3 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS v4.0 Base Score: 7.7 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/HI:H/NA:SC:N/NS:A:N CWE: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Additional Information Publication Date: 2026-10-13 Last Updated: 2026-10-13 Current Version: V1.0 CVSS v3.1 Base Score: 8.3 CVSS v4.0 Base Score: 7.7 Acknowledgments Siemens thanks the following individuals for their contributions: Ezinne Kalu reported and coordinated the disclosure Supplementary Information For more information on security vulnerabilities related to Siemens products and solutions, please contact Siemens ProductCERT: https://www.siemens.com/cert/advisories Revision History V1.0 (2026-10-13): Publication date Terms of Use The use of Siemens Security Advisories is subject to the listed terms and conditions: https://www.siemens.com/productcert/terms-of-use

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Industrial Edge App Publisher Certificate Validation & XSS Vulnerability Advisory