CVE-2024-45032CWE-639

A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1)

Critical · published September 10, 2024

CVSS v4.0
10.0
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

🔥 A critical vulnerability in Industrial Edge Management could let an attacker impersonate any device onboarded to the system with just a faulty device token! Think of it like a train station where anyone can hop on any train without a ticket — if the station doesn't check who gets on, chaos ensues! Imagine a cyber intruder blending in with your trusted devices, issuing commands and accessing sensitive data. This isn't just a minor glitch; it could lead to unauthorized control over critical industrial systems, putting both operations and safety at risk!

Put simply

Think of it like a train station where anyone can hop on any train without a ticket — if the station doesn't check who gets on, chaos ensues! The vulnerability arises because device tokens aren't validated correctly, allowing an unauthenticated remote attacker to impersonate other devices on the network, leading to potential unauthorized access and control.

What to do

Imagine a cyber intruder blending in with your trusted devices, issuing commands and accessing sensitive data. This isn't just a minor glitch; it could lead to unauthorized control over critical industrial systems, putting both operations and safety at risk! To mitigate this danger, upgrade to Industrial Edge Management Pro version 1.9.5 or later and Industrial Edge Management Virtual version 2.3.1-1 or later. Implement robust token validation protocols to ensure only authorized devices can communicate on the network. You've got this! Follow these steps, and you'll secure your system in no time! 🛡️

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00764 · 54.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-09-10T09:36Z
EPSS history
Timeline
  • 10 SEP 09:36Z
    A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1)
    cvelistv5