CVE-2024-45032
A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1). Affected components do not properly vali...
Affects 0 products across 1 vendor.
Software uses a user-supplied key to access resources without verifying authorization for that specific resource.
A critical vulnerability has been identified in Siemens Industrial Edge Management Pro and Virtual, affecting all versions prior to V1.9.5 and V2.3.1-1 respectively. The vulnerability stems from improper validation of device tokens, allowing an unauthenticated remote attacker to impersonate other devices onboarded to the system. This poses significant risks to the integrity and availability of industrial control systems.
BSID: BS-2024-GLOBAL-047069-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-45032?
What is the CVSS score for CVE-2024-45032?
Is CVE-2024-45032 actively exploited?
How do I remediate CVE-2024-45032?
What systems are affected by CVE-2024-45032?
What NERC-CIP standard applies to CVE-2024-45032?
What IEC 62443 requirement maps to CVE-2024-45032?
| CVE ID | CVE-2024-45032 |
|---|---|
| BSID | BS-2024-GLOBAL-047069-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2024-09-10 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 55% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1). Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices onboarded to the system.
Source: NIST NVD / MITRE CVE Database
The vulnerability can be exploited by an unauthenticated remote attacker who can send maliciously crafted requests to the affected Industrial Edge Management Pro and Virtual systems. The lack of proper token validation allows the attacker to impersonate legitimate devices, potentially leading to unauthorized access, data manipulation, and disruption of operations.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Siemens | — | — |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict token validation and authentication mechanisms on the Industrial Edge Management Pro and Virtual systems. Enforce mutual TLS (mTLS) for all device communications to ensure that only trusted devices can connect to the system.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows an unauthenticated remote attacker to impersonate devices, compromising the security of the electronic security perimeter and the integrity of the control systems.
This CVE maps to SR 7.6 because it involves the failure to validate device tokens, which is a critical aspect of ensuring secure communication and preventing unauthorized access to the industrial control system.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 251bdffac12fa7ec0d92700d6a34f1c9de25c9b339207fbc407027d5775abec5bc1b8cb5f0f13aabb554eb89e3826e60871a786ed19b2d2eb6a842e8a383a5ac |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →