A flaw in Siemens Industrial Edge products allows an authenticated user to query internal APIs and paths that are not properly access‑controlled. This can expose confidential configuration data and operational details, and in the worst case could be leveraged to gain further unauthorized access to the device.

Affected systems include Siemens Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit for arm64 and x86‑64 platforms, Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413 and LPE9433 models, SIMATIC IoT2050 Advanced IED and SM IED, and several SIMATIC IPC series devices. No specific firmware versions are listed, but all currently shipped configurations exhibit the same lack of restrictions on internal API access.

The CVSS base score is 6.9, indicating moderate severity; EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Attack requires authenticated remote credentials; once accessed, the exposed APIs can be used to read sensitive information and potentially facilitate privilege escalation. Given the need for valid credentials, the exploitation likelihood is lower than for exploits that do not require authentication, but the impact on confidentiality and future attack surface makes it a noteworthy risk.