Сиеменс использует OpenSSL.

View CSAF Summary OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. The following versions of Siemens Products using OpenSSL are affected: AI Lightweight Inference Server vers:all/* (CVE-2025-15467) Connector for Azure vers:intdot/ =4.0.700 (CVE-2025-15467) Siemens OPC UA Modelling Editor (SiOME) vers:all/* (CVE-2025-15467) SIMATIC Comfort/Mobile RT vers:all/* (CVE-2025-15467) SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8) vers:all/* (CVE-2025-15467) SIMATIC eaSie PCS 7 Skill Package (6DL5424-0BX00-0AV8) vers:all/* (CVE-2025-15467) SIMATIC HMI Basic Panels vers:intdot/ =6.3 (CVE-2025-15467) SINAMICS G220 vers:intdot/>=6.3 (CVE-2025-15467) SINAMICS S200 vers:intdot/>=6.3 (CVE-2025-15467) SINAMICS S210 vers:intdot/>=6.3 (CVE-2025-15467) SINAMICS S220 vers:intdot/>=6.3 (CVE-2025-15467) SINEC INS vers:intdot/<1.0.2.5 (CVE-2025-15467) SINEC NMS vers:all/* (CVE-2025-15467) SINEC Security Monitor vers:all/* (CVE-2025-15467) SINUMERIK Access MyMachine /OPC UA vers:all/* (CVE-2025-15467) SIPLANT vers:all/* (CVE-2025-15467) SITRANS ASM IQ vers:all/* (CVE-2025-15467) SITRANS Soft Sensor Engine IQ (SITRANS SSE IQ) vers:all/* (CVE-2025-15467) User Management Component (UMC) vers:intdot/<2.15.3.0 (CVE-2025-15467) Visual Inspection Cockpit vers:all/* (CVE-2025-15467) CVSS Vendor Equipment Vulnerabilities v3 9.8 Siemens Siemens Products using OpenSSL Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2025-15467 Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. View CVE Details Affected Products Siemens Products using OpenSSL Vendor: Siemens Product Version: AI Lightweight Inference Server, Connector for Azure, Databus, HiMed Cockpit, RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE LPE9403 (6GK5998-3GS00-2AC2), SCALANCE LPE9413 (6GK5998-3GS01-2AC2), SCALANCE LPE9433 (6GK5998-3GS11-2AC2), SCALANCE M804PB (6GK5804-0AP00-2AA2), SCALANCE M812-1 ADSL-Router family, SCALANCE M816-1 ADSL-Router family, SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2), SCALANCE M874-2 (6GK5874-2AA00-2AA2), SCALA