Authentication Bypass Vulnerability in Industrial Edge Device Kit by Siemens

CVE-2024-54092

Summary

A security issue exists in the Industrial Edge Device Kit, where devices fail to properly enforce user authentication on certain API endpoints when identity federation is in use. This vulnerability can allow an unauthenticated remote attacker to bypass security measures and impersonate a legitimate user. Successful exploitation necessitates that identity federation is currently or was previously enabled, as well as knowledge of a legitimate user's identity.

References