PT-2025-15395 · Siemens · Scalance Lpe9413+9

Published 2025-04-08 · Updated 2025-04-09 · CVE-2024-54092

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Industrial Edge Device Kit - arm64 versions V1.17 through V1.20.2-1, V1.21 versions prior to V1.21.1-1 Industrial Edge Device Kit - x86-64 versions V1.17 through V1.20.2-1, V1.21 versions prior to V1.21.1-1 Industrial Edge Own Device (IEOD) versions prior to V1.21.1-1-a Industrial Edge Virtual Device versions prior to V1.21.1-1-a SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (all versions) SIMATIC IPC BX-39A Industrial Edge Device versions prior to V3.0 SIMATIC IPC BX-59A Industrial Edge Device versions prior to V3.0 SIMATIC IPC127E Industrial Edge Device versions prior to V3.0 SIMATIC IPC227E Industrial Edge Device versions prior to V3.0 SIMATIC IPC427E Industrial Edge Device versions prior to V3.0 SIMATIC IPC847E Industrial Edge Device versions prior to V3.0

Description: The affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.

Recommendations: For Industrial Edge Device Kit - arm64 versions V1.17 through V1.20.2-1, update to version V1.20.2-1 or later. For Industrial Edge Device Kit - arm64 version V1.21, update to version V1.21.1-1 or later. For Industrial Edge Device Kit - x86-64 versions V1.17 through V1.20.2-1, update to version V1.20.2-1 or later. For Industrial Edge Device Kit - x86-64 version V1.21, update to version V1.21.1-1 or later. For Industrial Edge Own Device (IEOD) versions prior to V1.21.1-1-a, update to version V1.21.1-1-a or later. For Industrial Edge Virtual Device versions prior to V1.21.1-1-a, update to version V1.21.1-1-a or later. For SCALANCE LPE9413 (6GK5998-3GS01-2AC2), contact the vendor for a fix. For SIMATIC IPC BX-39A Industrial Edge Device versions prior to V3.0, update to version V3.0 or later. For SIMATIC IPC BX-59A Industrial Edge Device versions prior to V3.0, update to version V3.0 or later. For SIMATIC IPC127E Industrial Edge Device versions prior to V3.0, update to version V3.0 or later. For SIMATIC IPC227E Industrial Edge Device versions prior to V3.0, update to version V3.0 or later. For SIMATIC IPC427E Industrial Edge Device versions prior to V3.0, update to version V3.0 or later. For SIMATIC IPC847E Industrial Edge Device versions prior to V3.0, update to version V3.0 or later.

Fix

Weakness Enumeration

CWE-1390

Related Identifiers

BDU:2025-04022

CVE-2024-54092

Affected Products

Industrial Edge Device Kit

Industrial Edge Own Device

Industrial Edge Virtual Device

Scalance Lpe9413

Simatic Ipc Bx-39A Industrial Edge Device

Simatic Ipc Bx-59A Industrial Edge Device

Simatic Ipc127E Industrial Edge Device

Simatic Ipc227E Industrial Edge Device

Simatic Ipc427E Industrial Edge Device

Simatic Ipc847E Industrial Edge Device

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-54092 · Security Note
• https://bdu.fstec.ru/vul/2025-04022 · Security Note
• https://t.me/pentestingnews/59217 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-634640.html · Note
• https://twitter.com/CVEnew/status/1909528263204216955 · Twitter Post
• https://twitter.com/CveFindCom/status/1909524873547862083 · Twitter Post
• https://twitter.com/samilaiho/status/1909870654314144237 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1909613511409541430 · Twitter Post
• https://twitter.com/vulns_space/status/1909547427339657230 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-819629.html · Note