CVE-2024-54092

A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.

• CWE-1390

• https://cert-portal.siemens.com/productcert/html/ssa-634640.html
• https://cert-portal.siemens.com/productcert/html/ssa-819629.html

Published

Apr 8, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-54084APTIOV contains a vulnerability in BIOS where an attacker ma…7
• CVE-2024-54085AMI’s SPx contains a vulnerability in the BMC where an Attac…9.8
• CVE-2024-54089A vulnerability has been identified in APOGEE PXC Series (BA…8.7
• CVE-2024-5409RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" par…6.1
• CVE-2024-54090A vulnerability has been identified in APOGEE PXC Series (BA…6
• CVE-2024-54091A vulnerability has been identified in Solid Edge SE2024 (Al…7.8
• CVE-2024-54093A vulnerability has been identified in Solid Edge SE2024 (Al…7.8
• CVE-2024-54094A vulnerability has been identified in Solid Edge SE2024 (Al…7.8
• CVE-2024-54095A vulnerability has been identified in Solid Edge SE2024 (Al…7.8
• CVE-2024-54096Vulnerability of improper access control in the MTP module I…5.5
• CVE-2024-54097Security vulnerability in the HiView module Impact: Successf…7.5
• CVE-2024-54098Service logic error vulnerability in the system service modu…7.5