Vulnerability in Siemens Industrial Edge Device Kit - arm64 V1.10

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.1

[ Description ]Official description

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL13 Oct 2026NCSC-2026-0415

  Vulnerabilities fixed in Siemens products Translated from Dutch

  Probability/damage M/HCVE-2024-7322CVE-2025-6965CVE-2025-70873+38 more CVEs
• CERT-FR13 Oct 2026CERTFR-2026-AVI-1298

  Multiple vulnerabilities in Siemens products Translated from French

  Multiple vulnerabilities have been discovered in Siemens products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2021-41617CVE-2023-28531CVE-2023-51384+716 more CVEs
• BSI CERT-Bund12 Oct 2026WID-SEC-2026-3873

  Siemens Industrial Edge Devices: Multiple vulnerabilities Translated from German

  CVE-2026-44415CVE-2026-44414

[ References ]References

• cert-portal.siemens.com/productcert/html/ssa-377139.html
• cert-portal.siemens.com/productcert/html/ssa-832641.html