PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-45032 Siemens CVE debrief

CVE-2024-45032 is a critical authentication bypass vulnerability in Siemens Industrial Edge Management Pro and Industrial Edge Management Virtual. The affected components fail to properly validate device tokens, enabling an unauthenticated remote attacker to impersonate other devices that are onboarded to the system. This vulnerability carries a CVSS 3.1 score of 10.0 (Critical), reflecting its network attack vector, low attack complexity, no required privileges or user interaction, and high impacts to confidentiality, integrity, and availability with a changed scope. The vulnerability was published on September 10, 2024, with CISA ICS Advisory ICSA-24-256-11 and Siemens Security Advisory SSA-359713 issued the same day. Siemens has released vendor fixes: Industrial Edge Management Pro should be updated to version 1.9.5 or later, and Industrial Edge Management Virtual should be updated to version 2.3.1-1 or later. Organizations operating these systems should prioritize patching due to the critical severity and the potential for unauthenticated remote exploitation that could compromise the entire edge management infrastructure.

Vendor
Siemens
Product
Industrial Edge Management Pro
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2024-09-10
Original CVE updated
2024-09-10
Advisory published
2024-09-10
Advisory updated
2024-09-10

Who should care

Organizations operating Siemens Industrial Edge Management Pro or Virtual for industrial edge computing deployments, particularly in manufacturing, energy, and critical infrastructure sectors where device identity and trust boundaries are essential for operational security.

Technical summary

The vulnerability exists in the device token validation mechanism of Siemens Industrial Edge Management Pro and Virtual editions. Insufficient validation allows an attacker to craft or replay device tokens to impersonate legitimate onboarded devices without authentication. This exposes the edge management platform to complete compromise, as impersonated devices may inherit trust relationships and access privileges within the industrial edge environment. The attack requires no privileges or user interaction and can be executed remotely over the network.

Defensive priority

critical

Recommended defensive actions

  • Apply vendor patches immediately: update Industrial Edge Management Pro to version 1.9.5 or later, and Industrial Edge Management Virtual to version 2.3.1-1 or later
  • Review device onboarding logs for unauthorized device registrations or anomalous authentication patterns
  • Implement network segmentation to limit exposure of Industrial Edge Management systems to untrusted networks
  • Monitor for indicators of compromise related to device token misuse or unexpected device impersonation attempts
  • Apply CISA ICS recommended practices for defense-in-depth strategies for industrial control systems

Evidence notes

Vulnerability description and remediation details sourced from CISA CSAF advisory ICSA-24-256-11 and Siemens SSA-359713. CVSS vector confirms critical severity with network exploitable, unauthenticated attack path. Vendor fix versions explicitly specified in CSAF remediation section.

Official resources

2024-09-10