Skip to content
OpenAdvisories
High ICSA-26-174-03 1 CVE

Siemens Products using OpenSSL

Published Jun 9, 2026 · Updated Sep 15, 2026 · Revision 6

Vendor: Siemens Product: AI Lightweight Inference Server Product: Connector for Azure Product: Databus Product: HiMed Cockpit Product: RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) Product: RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) Product: RUGGEDCOM ROX MX5000 Product: RUGGEDCOM ROX MX5000RE Product: RUGGEDCOM ROX RX1400 Product: RUGGEDCOM ROX RX1500 Product: RUGGEDCOM ROX RX1501 Product: RUGGEDCOM ROX RX1510 Product: RUGGEDCOM ROX RX1511 Product: RUGGEDCOM ROX RX1512 Product: RUGGEDCOM ROX RX1524 Product: RUGGEDCOM ROX RX1536 Product: RUGGEDCOM ROX RX5000 Product: SCALANCE LPE9403 (6GK5998-3GS00-2AC2) Product: SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Product: SCALANCE LPE9433 (6GK5998-3GS11-2AC2) Product: SCALANCE M804PB (6GK5804-0AP00-2AA2) Product: SCALANCE M812-1 ADSL-Router family Product: SCALANCE M816-1 ADSL-Router family Product: SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) Product: SCALANCE M874-2 (6GK5874-2AA00-2AA2) Product: SCALANCE M874-3 (6GK5874-3AA00-2AA2) Product: SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) Product: SCALANCE M876-3 (6GK5876-3AA02-2BA2) Product: SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) +121 more

Summary

OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

  • High 8.8
    CVE-2025-15467 Public exploit EPSS 75%

    Stack buffer overflow in CMS (Auth)EnvelopedData parsing

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #6

    CISA Republication update based on Siemens ProductCERT SSA-434797 advisory

  2. #5

    Updated remediation for AI Lightweight Inference Server to no fix planned.

  3. #4

    Added RUGGEDCOM ROX II family and SIMATIC HMI Operator Device to Known Not Affected and removed SIMATIC Comfort/Mobile RT and updated SIMATIC Advanced HMI Panels and SIMATIC HMI Basic Panels to no fix available; Added fix for SIMATIC PDM V9.3 and added PCS neo V6.0 and Simatic Logon to affected products.

  4. #3

    Added SCALANCE X-200 family, X-200IRT family, X-200RNA family, X-300/408 family, SC-600 family to Known Not Affected and fix for SINUMERIK Access MyMachine /OPC UA , SIMOVE Fleetmanager. Updated remediation to No fix planned for SIMATIC Comfort/Mobile RT

  5. #2

    CISA Republication - Initial CISA Republication of Siemens ProductCERT SSA-434797 advisory

  6. #1

    Publication Date

References