CVE-2026-44414: Medium severity Siemens Industrial Edge Cloud Device (IECD) vulnerability

Published Oct 13, 2026
·
Updated

A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial Edge Device Kit - arm64 V1.15, Industrial Edge Device Kit - arm64 V1.16, Industrial Edge Device Kit - arm64 V1.17, Industrial Edge Device Kit - arm64 V1.18, Industrial Edge Device Kit - arm64 V1.19, Industrial Edge Device Kit - arm64 V1.20, Industrial Edge Device Kit - arm64 V1.21, Industrial Edge Device Kit - arm64 V1.22, Industrial Edge Device Kit - arm64 V1.23, Industrial Edge Device Kit - arm64 V1.24, Industrial Edge Device Kit - arm64 V1.25, Industrial Edge Device Kit - arm64 V1.26, Industrial Edge Device Kit - arm64 V1.27, Industrial Edge Device Kit - arm64 V1.28, Industrial Edge Device Kit - arm64 V1.5, Industrial Edge Device Kit - arm64 V1.6, Industrial Edge Device Kit - arm64 V1.7, Industrial Edge Device Kit - arm64 V1.8, Industrial Edge Device Kit - arm64 V1.9, Industrial Edge Device Kit - x86-64 V1.10, Industrial Edge Device Kit - x86-64 V1.11, Industrial Edge Device Kit - x86-64 V1.12, Industrial Edge Device Kit - x86-64 V1.13, Industrial Edge Device Kit - x86-64 V1.14, Industrial Edge Device Kit - x86-64 V1.15, Industrial Edge Device Kit - x86-64 V1.16, Industrial Edge Device Kit - x86-64 V1.17, Industrial Edge Device Kit - x86-64 V1.18, Industrial Edge Device Kit - x86-64 V1.19, Industrial Edge Device Kit - x86-64 V1.20, Industrial Edge Device Kit - x86-64 V1.21, Industrial Edge Device Kit - x86-64 V1.22, Industrial Edge Device Kit - x86-64 V1.23, Industrial Edge Device Kit - x86-64 V1.24, Industrial Edge Device Kit - x86-64 V1.25, Industrial Edge Device Kit - x86-64 V1.26, Industrial Edge Device Kit - x86-64 V1.27, Industrial Edge Device Kit - x86-64 V1.28, Industrial Edge Device Kit - x86-64 V1.5, Industrial Edge Device Kit - x86-64 V1.6, Industrial Edge Device Kit - x86-64 V1.7, Industrial Edge Device Kit - x86-64 V1.8, Industrial Edge Device Kit - x86-64 V1.9, Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413 (6GK5998-3GS01-2AC2), SCALANCE LPE9433 (6GK5998-3GS11-2AC2), SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2), SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2), SIMATIC IPC BX-21A Industrial Edge Device, SIMATIC IPC BX-39A Industrial Edge Device, SIMATIC IPC BX-59A Industrial Edge Device, SIMATIC IPC127E Industrial Edge Device, SIMATIC IPC227E Industrial Edge Device, SIMATIC IPC227G Industrial Edge Device, SIMATIC IPC427E Industrial Edge Device, SIMATIC IPC847E Industrial Edge Device. Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system.

Affected Software

17 affected components
Siemens Industrial Edge Cloud Device (IECD)
Siemens Industrial Edge Device Kit - arm64=1.5, =1.6, =1.7, =1.8, =1.9, =1.10, =1.11, =1.12, =1.13, =1.14, =1.15, =1.16, =1.17, =1.18, =1.19, =1.20, =1.21, =1.22, =1.23, =1.24, =1.25, =1.26, =1.27, =1.28
Siemens Industrial Edge Device Kit - x86-64=1.5, =1.6, =1.7, =1.8, =1.9, =1.10, =1.11, =1.12, =1.13, =1.14, =1.15, =1.16, =1.17, =1.18, =1.19, =1.20, =1.21, =1.22, =1.23, =1.24, =1.25, =1.26, =1.27, =1.28
Siemens Industrial Edge Own Device (IEOD)
Siemens Industrial Edge Virtual Device (IEVD)
Siemens SCALANCE LPE9413 (6GK5998-3GS01-2AC2)
Siemens SCALANCE LPE9433 (6GK5998-3GS11-2AC2)
Siemens SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2)
Siemens SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2)
Siemens SIMATIC IPC BX-21A Industrial Edge Device
Siemens SIMATIC IPC BX-39A Industrial Edge Device
Siemens SIMATIC IPC BX-59A Industrial Edge Device
Siemens SIMATIC IPC127E Industrial Edge Device
Siemens SIMATIC IPC227E Industrial Edge Device
Siemens SIMATIC IPC227G Industrial Edge Device
Siemens SIMATIC IPC427E Industrial Edge Device
Siemens SIMATIC IPC847E Industrial Edge Device

Event History

Oct 13, 2026
CVE Published
via MITRE·09:18 AM
Data Sourced
via MITRE·09:18 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What level of access does an attacker need to exploit this issue?

Exploitation is network-accessible, requires low attack complexity, and does not require user interaction. However, the attacker must already hold high privileges.

2

What is the expected security impact?

The vulnerability can result in high-impact disclosure of confidential information. The CVSS vector indicates no integrity or availability impact, but scope can extend beyond the initially affected security authority.

3

Which deployments should be reviewed first?

Review network-reachable deployments of Siemens Industrial Edge Cloud Device, Industrial Edge Device Kit for arm64 or x86-64, Industrial Edge Own Device, Industrial Edge Virtual Device, SCALANCE LPE9413 or LPE9433, and SIMATIC IoT2050 Advanced IED. The provided affected-version list includes multiple Industrial Edge Device Kit releases, but is truncated, so the available data does not establish complete version boundaries.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203