Siemens Industrial Edge App Publisher
The Industrial Edge App Publisher contains a vulnerability chain involving improper certificate validation and the rendering of unescaped data from backend responses. These issues can be combined to allow an attacker on the network to impersonate the management server and execute arbitrary code (RCE) on the local machine through Node.js integration. Siemens has released an update for the Industrial Edge App Publisher and recommends to update to the latest version. The following versions of Siemens Industrial Edge App Publisher are affected: Industrial Edge App Publisher vers:
Read at CISA Cybersecurity Advisories
- Vendor
- Node.js, Siemens
- Product
- Node.js, SIMATIC / RUGGEDCOM / SINEC / SCALANCE / WinCC / TIA Portal
- CVSS v3.1
- 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 0.003 (p24)
- Fix
- available
- Exposure class
- Developer platform, OT / ICS
Why it ranks 32 (Notable)
- Product class: developer platform, OT / ICS
- Covered by 3 independent sources
- Fix available
- Government advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- CISA Cybersecurity Advisories (cisa.gov)
- CVE-2026-78556 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-78557 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.