CVE-2024-45032

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1). Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices onboarded to the system.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Siemens	Industrial Edge Management Pro	< V1.9.5
Siemens	Industrial Edge Management Virtual	< V2.3.1-1
siemens	industrial_edge_management_pro	< 1.9.5
siemens	industrial_edge_management_virtual	< 2.3.1-1

References

https://cert-portal.siemens.com/productcert/html/ssa-359713.html

Timeline

Published: Sep 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-450338.1Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2.CVE-2024-450348.8Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it execut CVE-2024-450364.3Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the `TOPHAT_APP_TOKEN` token stored in CVE-2024-450376.4The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Customers use it to create the CVE-2024-450387.5Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on CVE-2024-450396.2gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case CVE-2024-45047.2A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240428. Affected by this issue is some unknown fu CVE-2024-450405.9gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments to private witnesses CVE-2024-450418.8External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment CVE-2024-450424.4Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of precondit CVE-2024-450435.3The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the CVE-2024-450448.8Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user