{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-33892",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-33892",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-04-14T08:40:46.807Z",
    "updatedAt": "2026-04-14T13:46:34.636Z",
    "importedAt": "2026-10-24T01:58:08.712Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": null,
      "summary": "A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >= V2.0.0 < V2.1.1), Industrial Edge Management Virtual (All versions >= V2.2.0 < V2.8.0). Affected management systems do not properly enforce user authentication on remote connections to devices.\r\nThis could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user.\r\nSuccessful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device.\r\n\r\nExploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.",
      "affected": [
        {
          "vendor": "Siemens",
          "product": "Industrial Edge Management Pro V1",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "V1.7.6",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "V1.15.17"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Industrial Edge Management Pro V2",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "V2.0.0",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "V2.1.1"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "Industrial Edge Management Virtual",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "V2.2.0",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "V2.8.0"
            }
          ]
        }
      ]
    }
  }
}