CVE-2024-54092

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-08 · updated 2026-06-17
Weakness: CWE-1390

Description

A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.

Affected products

Siemens Industrial Edge Device Kit - arm64 V1.17: all versions
Siemens Industrial Edge Device Kit - arm64 V1.18: all versions
Siemens Industrial Edge Device Kit - arm64 V1.19: all versions
Siemens Industrial Edge Device Kit - arm64 V1.20: before V1.20.2-1 — fixed in V1.20.2-1
Siemens Industrial Edge Device Kit - arm64 V1.21: before V1.21.1-1 — fixed in V1.21.1-1
Siemens Industrial Edge Device Kit - x86-64 V1.17: all versions
Siemens Industrial Edge Device Kit - x86-64 V1.18: all versions
Siemens Industrial Edge Device Kit - x86-64 V1.19: all versions
Siemens Industrial Edge Device Kit - x86-64 V1.20: before V1.20.2-1 — fixed in V1.20.2-1
Siemens Industrial Edge Device Kit - x86-64 V1.21: before V1.21.1-1 — fixed in V1.21.1-1
Siemens Industrial Edge Own Device (IEOD): before V1.21.1-1-a — fixed in V1.21.1-1-a
Siemens Industrial Edge Virtual Device: before V1.21.1-1-a — fixed in V1.21.1-1-a
Siemens SCALANCE LPE9413: before V2.1 — fixed in V2.1
Siemens SIMATIC IPC127E Industrial Edge Device: before V3.0 — fixed in V3.0
Siemens SIMATIC IPC227E Industrial Edge Device: before V3.0 — fixed in V3.0
Siemens SIMATIC IPC427E Industrial Edge Device: before V3.0 — fixed in V3.0
Siemens SIMATIC IPC847E Industrial Edge Device: before V3.0 — fixed in V3.0
Siemens SIMATIC IPC BX-39A Industrial Edge Device: before V3.0 — fixed in V3.0
Siemens SIMATIC IPC BX-59A Industrial Edge Device: before V3.0 — fixed in V3.0

How to fix

Upgrade to a fixed version: Siemens Industrial Edge Device Kit - arm64 V1.20 V1.20.2-1; Siemens Industrial Edge Device Kit - arm64 V1.21 V1.21.1-1; Siemens Industrial Edge Device Kit - x86-64 V1.20 V1.20.2-1; Siemens Industrial Edge Device Kit - x86-64 V1.21 V1.21.1-1; Siemens Industrial Edge Own Device (IEOD) V1.21.1-1-a; Siemens Industrial Edge Virtual Device V1.21.1-1-a; Siemens SCALANCE LPE9413 V2.1; Siemens SIMATIC IPC127E Industrial Edge Device V3.0; Siemens SIMATIC IPC227E Industrial Edge Device V3.0; Siemens SIMATIC IPC427E Industrial Edge Device V3.0; Siemens SIMATIC IPC847E Industrial Edge Device V3.0; Siemens SIMATIC IPC BX-39A Industrial Edge Device V3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-54092 or the next vulnerability affects your stack