Advisories › Siemens › ICSA-26-295-09
Siemens Industrial Edge Device Kit: 2 CVEs, Critical 9.1
Summary
CISA reports 2 vulnerabilities in Siemens Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13 and 44 more. Weakness type: Path Traversal: '.../...//'. Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Highest CVSS v3 score: 9.1 (Critical), exploitable over the network.
What to do: Act now: Update to V1.26.2-1 or later version
Why this matters for oil & gas: Siemens (SIMATIC S7, PCS 7, WinCC, RUGGEDCOM) is widely used in process plants and pipelines.
At a glance
- Vendor
- Siemens
- Products
- Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial Edge Device Kit - arm64 V1.15, Industrial Edge Device Kit - arm64 V1.16, Industrial Edge Device Kit - arm64 V1.17
- CVEs
- CVE-2026-44414, CVE-2026-44415
- Highest CVSS v3
- 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-44414 | Path Traversal: '.../...//' | 6.8 | – | No | CVE-2026-44414 |
| CVE-2026-44415 | Path Traversal: '.../...//' | 9.1 | – | No | CVE-2026-44415 |
Affected products (48)
- Industrial Edge Device Kit - arm64 V1.10
- Industrial Edge Device Kit - arm64 V1.11
- Industrial Edge Device Kit - arm64 V1.12
- Industrial Edge Device Kit - arm64 V1.13
- Industrial Edge Device Kit - arm64 V1.14
- Industrial Edge Device Kit - arm64 V1.15
- Industrial Edge Device Kit - arm64 V1.16
- Industrial Edge Device Kit - arm64 V1.17
- Industrial Edge Device Kit - arm64 V1.18
- Industrial Edge Device Kit - arm64 V1.19
- Industrial Edge Device Kit - arm64 V1.20
- Industrial Edge Device Kit - arm64 V1.21
- Industrial Edge Device Kit - arm64 V1.22
- Industrial Edge Device Kit - arm64 V1.23
- Industrial Edge Device Kit - arm64 V1.24
- Industrial Edge Device Kit - arm64 V1.25
- Industrial Edge Device Kit - arm64 V1.26 < V1.26.2-1
- Industrial Edge Device Kit - arm64 V1.27 < V1.27.1-1
- Industrial Edge Device Kit - arm64 V1.28 < V1.28.0-6
- Industrial Edge Device Kit - arm64 V1.5
- Industrial Edge Device Kit - arm64 V1.6
- Industrial Edge Device Kit - arm64 V1.7
- Industrial Edge Device Kit - arm64 V1.8
- Industrial Edge Device Kit - arm64 V1.9
- Industrial Edge Device Kit - x86-64 V1.10
- Industrial Edge Device Kit - x86-64 V1.11
- Industrial Edge Device Kit - x86-64 V1.12
- Industrial Edge Device Kit - x86-64 V1.13
- Industrial Edge Device Kit - x86-64 V1.14
- Industrial Edge Device Kit - x86-64 V1.15
- Industrial Edge Device Kit - x86-64 V1.16
- Industrial Edge Device Kit - x86-64 V1.17
- Industrial Edge Device Kit - x86-64 V1.18
- Industrial Edge Device Kit - x86-64 V1.19
- Industrial Edge Device Kit - x86-64 V1.20
- Industrial Edge Device Kit - x86-64 V1.21
- Industrial Edge Device Kit - x86-64 V1.22
- Industrial Edge Device Kit - x86-64 V1.23
- Industrial Edge Device Kit - x86-64 V1.24
- Industrial Edge Device Kit - x86-64 V1.25
Show 8 more
- Industrial Edge Device Kit - x86-64 V1.26 < V1.26.2-1
- Industrial Edge Device Kit - x86-64 V1.27 < V1.27.1-1
- Industrial Edge Device Kit - x86-64 V1.28 < V1.28.0-6
- Industrial Edge Device Kit - x86-64 V1.5
- Industrial Edge Device Kit - x86-64 V1.6
- Industrial Edge Device Kit - x86-64 V1.7
- Industrial Edge Device Kit - x86-64 V1.8
- Industrial Edge Device Kit - x86-64 V1.9
Vendor fixes and mitigations (from advisory)
- Mitigation: Ensure network access to affected products is limited to trusted parties only
- No Fix Planned: Currently no fix is planned
- Vendor Fix: Update to V1.26.2-1 or later version
- Vendor Fix: Update to V1.27.1-1 or later version
- Vendor Fix: Update to V1.28.0-6 or later version
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-295-09
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-377139.json
- https://cert-portal.siemens.com/productcert/html/ssa-377139.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.