Siemens Industrial Edge Management

Siemens Industrial Edge Management products were exposed to a CVSS 9.8 buffer overflow vulnerability originating in the Google Brotli compression library (versions 1.0.3–1.2.0), a third-party dependency embedded across multiple products. Because the vulnerable library was not promptly identified and patched within the product supply chain, unauthenticated remote attackers could exploit it to execute arbitrary code, disclose sensitive data, or cause denial of service on operational technology systems. This highlights the critical risk posed by unmanaged third-party library dependencies in industrial control software, where delayed patching windows can leave critical infrastructure exposed for extended periods. The incident underscores that vulnerability management programs must extend beyond first-party code to continuously track and remediate known-vulnerable components in the software bill of materials (SBOM).