attack vector is network; attack complexity is high; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is none.
Affected products
Siemens Industrial Edge App Publisher
Classified as
CWE-295 (Improper Certificate Validation)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Siemens
Industrial Edge App Publisher
Subsystems
General OT
Sectors
Multiple
What to Know
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server. (NVD)
What to Do
Monitor Siemens's web page for any future patch releases.