• Configure a Web Application Firewall (WAF) or Reverse Proxy
  If complete blocking of internet access is not immediately feasible, you can use a Web Application Firewall (WAF) or a Reverse Proxy to block the affected path. Please configure your WAF or Reverse Proxy to block the following path:
  /auth/realms/customer/login-actions/reset-credentials
  Please note that by blocking this path, the password reset functionality will be unavailable.

• Block direct internet access to IEM Pro / IEM Virtual
  The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.

• Deactivate Password Reset in Keycloak Realm Settings
  Deactivate the password reset functionality directly within the Keycloak realm settings. To do this, navigate to:
  Identity & access management > realm settings > Login > Forgot password > Off
  Please note that by deactivating this setting, the password reset functionality will be unavailable.

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.