[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fW1TK7xCm-qWNC0R4V3tZJp_JcliWyNHEr5sWQDo-_zc":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"88714076-a968-4c41-88c5-7aa5e82a24b5","Siemens Industrial Edge Management","siemens-industrial-edge-management-ff020d","View CSAF Summary Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup: - No Management Applications installed: No action is required. Although the affected Brotli library is included in the IEM software stack, the affected functionality is not used or exposed. The same applies to IEDK. - Management Applications installed: Follow the specific mitigations until a fix is available. - Device Applications installed: Follow the specific mitigations until a fix is available. For Siemens-managed services, Industrial Edge Hub and Industrial Edge Management Cloud, appropriate Firewall\u002FWAF protection has already been implemented. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available. The following versions of Siemens Industrial Edge Management are affected: Cloud Connector Configurator vers:intdot\u002F\u003C1.24.3 (CVE-2026-111497) Common Configurator (CC on IEM) vers:all\u002F* (CVE-2026-111497) Common Configurator on Device (CC on Edge) vers:all\u002F* (CVE-2026-111497) Data Flow Monitoring vers:intdot\u002F\u003C3.0.18 (CVE-2026-111497) Databus Configurator vers:intdot\u002F\u003C4.0.1 (CVE-2026-111497) DataXess Configurator vers:intdot\u002F\u003C1.5.7 (CVE-2026-111497) Edge OPC UA Server Configurator vers:intdot\u002F\u003C2.3.10 (CVE-2026-111497) Flow Creator Configurator vers:intdot\u002F\u003C1.15.1 (CVE-2026-111497) Industrial Edge Hub vers:all\u002F* (CVE-2026-111497) Industrial Edge Management Cloud vers:all\u002F* (CVE-2026-111497) CVSS Vendor Equipment v3 9.8 Siemens Cloud Connector Configurator 1 Vulnerability Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c\u002Fdec\u002Fdecode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Read More 10 Affected Products Cloud Connector Configurator \u003C V1.24.3 Product Status: known_affected Remediations Vendor fix Update to V1.24.3 or later version Industrial Edge Management Cloud Product Status: known_affected Remediations Vendor fix Vulnerability fixed on central cloud service starting 2026-10-28; no user actions necessary Common Configurator (CC on IEM) Product Status: known_affected Remediations Mitigation Uninstall all Management Applications and protect your IEM instance with a Firewall\u002FWAF until a fix is available None available Currently no fix is available Common Configurator on Device (CC on Edge) Product Status: known_affected Remediations Mitigation Stop Common Configurator on Device (CC on Edge) until a fix is available None available Currently no fix is available Data Flow Monitoring \u003C V3.0.18 Product Status: known_affected Remediations Vendor fix Update to V3.0.18 or later version Databus Configurator \u003C V4.0.1 Product Status: known_affected Remediations Vendor fix Update to V4.0.1 or later version DataXess Configurator \u003C V1.5.7 Product Status: known_affected Remediations Vendor fix Update to V1.5.7 or later version Edge OPC UA Server Configurator \u003C V2.3.10 Product Status: known_affected Remediations Vendor fix Update to V2.3.10 or later version Flow Creator Configurator \u003C V1.15.1 Product Status: known_affected Remediations Vendor fix Update to V1.15.1 or later version Industrial Edge Hub Product Status: known_affected Remediations Vendor fix Vulnerability fixed on central cloud service starting 2026-10-29; no user actions necessary Additional Metrics Relevant CWE: CWE-787 Out-of-bounds Write CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H View CVE Details Acknowledgments Siemens ProductCERT reported this vulnerability to CISA. General Recommendations As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for Industrial Security (https:\u002F\u002Fwww.siemens.com\u002Fcert\u002Foperational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https:\u002F\u002Fwww.siemens.com\u002Findustrialsecurity Additional Resources For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https:\u002F\u002Fwww.siemens.com\u002Fcert\u002Fadvisories Terms of Use The use of Siemens Security Advisories is subject to the terms and conditions listed on: https:\u002F\u002Fwww.siemens.com\u002Fproductcert\u002Fterms-of-use. Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and\u002For systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Advisory Conversion Disclaimer This ICSA is a verbatim republication of Siemens ProductCERT SSA-443410 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory. Revision History Initial Release Date: 2026-10-30 Date Revision Summary 2026-10-30 1 Publication Date 2026-11-06 2 Added fix for Cloud Connector Configurator, Data Flow Monitoring, Databus Configurator, Edge OPC UA Server Configurator and Flow Creator Configurator; Added DataXess Configurator as affected product 2026-11-12 3 Initial CISA Republication of Siemens ProductCERT SSA-443410 advisory Legal Notice and Terms of Use","Siemens disclosed that multiple Industrial Edge Management (IEM) products are vulnerable to CVE-2026-111497, a buffer overflow in Google Brotli library versions 1.0.3–1.2.0 affecting decoding functions. The vulnerability (CVSS 9.8) allows unauthenticated remote attackers to corrupt memory, disclose sensitive data, cause denial of service, or execute arbitrary code. Siemens has released patches for several products (Cloud Connector Configurator 1.24.3, Data Flow Monitoring 3.0.18, Databus Configurator 4.0.1, and others) and recommends updating to the latest versions; mitigations for unpatched products include uninstalling Management Applications and deploying Firewall\u002FWAF protection.","Siemens Industrial Edge Management affected by Node2Shell buffer overflow (CVE-2026-111497)","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-316-03",null,"2026-11-12T12:00:00+00:00","2026-11-12T18:00:31.8923+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Siemens","vendor",{"name":21,"type":22},"Industrial Edge Management","product",{"name":24,"type":22},"Cloud Connector Configurator",{"name":26,"type":22},"Common Configurator",{"name":28,"type":29},"Google Brotli","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":12,"name":32,"slug":33},"Vulnerabilities","vulnerabilities",[35,40,45],{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":46},{"id":47,"icon":12,"name":48,"slug":49},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-111497","Buffer overflow in Google Brotli decoder affecting Siemens Industrial Edge Management",[18,21,24],{"controls":57,"vendors":145},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":117,"name":118,"problem":119,"products":120},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",[146],{"slug":147,"name":18,"logo_path":148,"roles":149},"siemens","\u002Fvendor-logos\u002Fsiemens.png",[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":161},"critical-buffer-overflow-in-third-party-library-exposes-siemens-industrial-edge-systems","Critical Buffer Overflow in Third-Party Library Exposes Siemens Industrial Edge Systems","Siemens Industrial Edge Management products were exposed to a CVSS 9.8 buffer overflow vulnerability originating in the Google Brotli compression library (versions 1.0.3–1.2.0), a third-party dependency embedded across multiple products. Because the vulnerable library was not promptly identified and patched within the product supply chain, unauthenticated remote attackers could exploit it to execute arbitrary code, disclose sensitive data, or cause denial of service on operational technology systems. This highlights the critical risk posed by unmanaged third-party library dependencies in industrial control software, where delayed patching windows can leave critical infrastructure exposed for extended periods. The incident underscores that vulnerability management programs must extend beyond first-party code to continuously track and remediate known-vulnerable components in the software bill of materials (SBOM).",[156,157,158,159,160],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIST CSF 2.0 ID.AM-02: Inventories of software, services, and systems are maintained",{"NIS2 Article 21(2)(e)":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"CIS Control 7: Continuous Vulnerability Management (v8)":164,"CIS Control 2: Inventory and Control of Software Assets (v8)":165,"NIST CSF 2.0 ID.AM-02: Inventories of software, services, and systems are maintained":166},"This point requires security in acquisition, development and maintenance including vulnerability handling, which directly covers the obligation to track and remediate vulnerable third-party components like Brotli in critical infrastructure products.","SI-2 requires organizations to identify, report, and correct information system flaws, which would have mandated prompt patching of the known-vulnerable Brotli library versions across all affected IEM products.","A continuous vulnerability management process that maps newly published CVEs against deployed software components would have triggered timely patching of the Brotli library before exploitation was possible.","Tracking all third-party libraries (including Brotli) as part of the software asset inventory would have immediately surfaced which products were running vulnerable versions when the CVE was disclosed.","Maintaining an accurate inventory inclusive of third-party library dependencies would have enabled Siemens customers to quickly determine their exposure to the vulnerable Brotli versions upon disclosure."]