CVE-2024-0860 is a high severity (CVSS 8.0) cleartext transmission of sensitive information in Softing edgeAggregator and edgeConnector 3.60. An attacker who captures packets may craft their own requests. Follow the CISA advisory ICSA-24-074-13 and Softing's guidance, and isolate the networks.
What's affected
Softing edgeAggregator and edgeConnector, version 3.60 per the CPE data. The record says the affected product is vulnerable to cleartext transmission of sensitive information, which may allow an attacker to capture packets and craft their own requests.
The reference is the CISA ICS advisory ICSA-24-074-13. The record names no fixed version, so use the advisory.
The record classifies the weakness as CWE-319 (cleartext transmission of sensitive information). NVD scores it 8.0 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
How to check if you're exposed
Open the product's about page or configuration tool to read the installed version, then compare it with the CISA advisory. Because industrial products often sit on isolated networks, also confirm which hosts can reach them. A network diagram or a port scan from an authorised management host will show unexpected paths.
What to do now
- Inventory edgeAggregator and edgeConnector installs and their versions.
- Read ICSA-24-074-13 and Softing's guidance for the fixed release and configuration changes.
- Keep the products on isolated networks and do not expose them to the internet.
- Where possible, carry the traffic through an encrypted tunnel such as a VPN until a fix is applied.
Why it matters
Cleartext transmission (CWE-319) means sensitive data crosses the network unencrypted. Anyone on the path can read it, and in this case can copy what they see to build requests of their own.
Industrial networks often rely on isolation more than encryption, so segmentation is the first mitigation.
Two habits help with issues of this kind. First, keep a current inventory that records which machines run the product and which version, so a new advisory becomes a quick query instead of a hunt. Second, write down the owner of each system. Many fixes slip because nobody was sure who could approve the downtime. The free in-browser dependency scan at the scan page covers the application dependencies in your repositories, and the Gold directory lists known vulnerabilities by CVE, so you can see related entries for the same product.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Who publishes the fix details?
Softing, with the advisory from CISA. The record does not list a fixed version.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
