SSA-443410

Siemens Security Advisory by Siemens ProductCERT

SSA-443410: Node2Shell Vulnerability in Industrial Edge Management Applications

Publication Date:	2026-10-30
Last Update:	2026-10-30
Current Version:	V1.0
CVSS v3.1 Base Score:	9.8
CVSS v4.0 Base Score:	9.2

SUMMARY

Siemens is currently assessing the impact of Node2Shell (CVE-2026-111497) on Industrial Edge. Please check your Industrial Edge Management (IEM) setup:

No Management Applications installed: No action is required. Although the affected Brotli library is included in the IEM software stack, the affected functionality is not used or exposed. The same applies to IEDK.
Management Applications installed: Follow the specific mitigations until a fix is available.

For Siemens-managed services, Industrial Edge Hub and Industrial Edge Management Cloud, appropriate Firewall/WAF protection has already been implemented.

Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
Industrial Edge Hub All versions affected by CVE-2026-111497	Vulnerability fixed on central cloud service starting 2026-10-29; no user actions necessary
Industrial Edge Management Applications	Show more details
Cloud Connector Configurator All versions affected by CVE-2026-111497	Currently no fix is available Uninstall all Management Applications and protect your IEM instance with a Firewall/WAF until a fix is available
Common Configurator on Device (CC on Edge) All versions affected by CVE-2026-111497	Currently no fix is available Stop Common Configurator on Device (CC on Edge) until a fix is available
Common Configurator (CC on IEM) All versions affected by CVE-2026-111497	Currently no fix is available Uninstall all Management Applications and protect your IEM instance with a Firewall/WAF until a fix is available
Data Flow Monitoring All versions affected by CVE-2026-111497	Currently no fix is available Stop Data Flow Monitoring until a fix is available
Databus Configurator All versions affected by CVE-2026-111497	Currently no fix is available Uninstall all Management Applications and protect your IEM instance with a Firewall/WAF until a fix is available
Edge OPC UA Server Configurator All versions affected by CVE-2026-111497	Currently no fix is available Uninstall all Management Applications and protect your IEM instance with a Firewall/WAF until a fix is available
Flow Creator Configurator All versions affected by CVE-2026-111497	Currently no fix is available Uninstall all Management Applications and protect your IEM instance with a Firewall/WAF until a fix is available
Industrial Edge Management Cloud All versions affected by CVE-2026-111497	Vulnerability fixed on central cloud service starting 2026-10-28; no user actions necessary

MITIGATIONS

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

Industrial Edge represents an open, ready-to-use Edge computing platform consisting of Edge devices, Edge apps, Edge connectivity, and an application and device management infrastructure.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	9.2
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-787: Out-of-bounds Write

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-10-30):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.