[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-siemens-industrial-edge-app-publisher-flaws-chain-into-rce":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},12189,"siemens-industrial-edge-app-publisher-flaws-chain-into-rce","Siemens Industrial Edge App Publisher Flaws Chain Into RCE","Two bugs in Siemens' Industrial Edge App Publisher let a network attacker pose as the management server and run code; version 1.27.9 fixes both.","Anyone running Siemens Industrial Edge App Publisher below version 1.27.9 should update to 1.27.9 or later. The update fixes two flaws that, combined, let an attacker on the network run their own code on the machine hosting the software.\n\nThe first flaw, CVE-2026-78556, is that the software does not properly validate the server certificate when it opens a TLS connection. TLS is the encryption handshake that proves a client is talking to the right server. An attacker sitting between the Publisher and its management server can intercept the traffic and impersonate that server. It scores 7.4 out of 10 on CVSS, the standard severity scale.\n\nThe second, CVE-2026-78557, is that the application renders data from backend responses without escaping it. Because the front end is integrated with Node.js, injected JavaScript can reach the underlying machine and achieve remote code execution (RCE), meaning the attacker's code runs on the victim's computer. It scores 8.3. Its vector marks it as needing user interaction and as high complexity to pull off.\n\nThe pairing is what matters. The second bug needs a malicious backend response, and the first bug lets an attacker supply one by posing as the backend. Cross-site scripting normally stays inside a browser tab. Node.js integration is what turns it into a problem for the whole machine.\n\nThe preconditions limit the risk. Both flaws are rated high attack complexity, and the attacker needs a position on the network path. The advisory does not say either bug has been exploited. Still, Siemens lists the software as deployed worldwide, with affected sectors spanning critical manufacturing, energy, transportation, healthcare, financial services and government facilities.\n\nSiemens ProductCERT reported the flaws to CISA. Siemens published its advisory, SSA-968435, on October 13. CISA republished it verbatim on October 22 and said it is not responsible for the advisory's accuracy.\n\nThe mitigation advice is the usual set: keep control systems off the internet, put them behind firewalls, and use updated VPNs for remote access. Here it targets the attack's main precondition. If an attacker cannot get onto the network path, the certificate flaw has nothing to exploit.","[\"siemens\",\"ics-security\",\"vulnerability\",\"rce\"]","2026-10-22T12:00:00.000Z","2026-10-22T19:20:05.457Z","2026-10-22T19:20:07.251Z","published",null,[],"security",[26,27,28,29],"siemens","ics-security","vulnerability","rce",[31],{"name":32,"url":33},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-295-02",0,{"sections":36},[37,42,46,51,56,61,66,71,76,81,86,91,96,101],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",7065,"2026-10-22T21:51:25.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",1057,"2026-10-22T15:11:26.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",574,"2026-10-22T20:23:48.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",559,"2026-10-22T21:00:00.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",288,"2026-10-22T17:25:00.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",285,"2026-10-22T22:21:59.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",215,"2026-10-22T16:37:00.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Startups","startups",143,"2026-10-22T18:38:47.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",141,"2026-10-22T20:02:35.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"General","general",97,"2026-10-22T21:05:05.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",87,"2026-10-22T18:14:24.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]