CVE-2026-78556: High severity Siemens Industrial Edge App Publisher vulnerability
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Industrial Edge App Publisherto a version that resolves this vulnerability.Fixed in V1.27.9
Event History
Frequently Asked Questions
Which deployments are affected?
Siemens Industrial Edge App Publisher versions earlier than V1.27.9 are affected. The available information does not identify any further configuration-specific limitations.
What does an attacker need to exploit this issue?
An attacker must be able to interfere with the network path between Industrial Edge App Publisher and the server it is attempting to reach. Exploitation involves intercepting and relaying the TLS communication or impersonating a trusted endpoint; no privileges or user interaction are required.
What is the primary remediation?
Update Siemens Industrial Edge App Publisher to V1.27.9 or later. Versions before V1.27.9 are within the affected range.