Skip to content
OpenAdvisories
High SSA-434797 1 CVE

SSA-434797: Buffer Overflow Vulnerability in OpenSSL affecting Siemens Products

Published Jun 9, 2026 · Updated Nov 10, 2026 · Revision 6

Vendor: Siemens Product: AI Lightweight Inference Server Product: Connector for Azure Product: Databus Product: HiMed Cockpit Product: RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) Product: RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) Product: RUGGEDCOM ROX MX5000 Product: RUGGEDCOM ROX MX5000RE Product: RUGGEDCOM ROX RX1400 Product: RUGGEDCOM ROX RX1500 Product: RUGGEDCOM ROX RX1501 Product: RUGGEDCOM ROX RX1510 Product: RUGGEDCOM ROX RX1511 Product: RUGGEDCOM ROX RX1512 Product: RUGGEDCOM ROX RX1524 Product: RUGGEDCOM ROX RX1536 Product: RUGGEDCOM ROX RX5000 Product: SCALANCE LPE9403 (6GK5998-3GS00-2AC2) Product: SCALANCE LPE9413 (6GK5998-3GS01-2AC2) Product: SCALANCE LPE9433 (6GK5998-3GS11-2AC2) Product: SCALANCE M804PB (6GK5804-0AP00-2AA2) Product: SCALANCE M812-1 ADSL-Router family Product: SCALANCE M816-1 ADSL-Router family Product: SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) Product: SCALANCE M874-2 (6GK5874-2AA00-2AA2) Product: SCALANCE M874-3 (6GK5874-3AA00-2AA2) Product: SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) Product: SCALANCE M876-3 (6GK5876-3AA02-2BA2) Product: SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) +121 more

Summary

OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.

Vulnerabilities 1

  • High 8.8
    CVE-2025-15467 Public exploit EPSS 75%

    Stack buffer overflow in CMS (Auth)EnvelopedData parsing

    Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote c…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Revision history

  1. #6

    Clarified that there is no fix planned for SIMATIC eaSie Core Package V26 and SIMATIC eaSie PCS 7 Skill Package V26 (6DL5424-0BX00-0AV8); Clarified that SIMATIC IoT2050 family is not affected

  2. #5

    Added fix version for SIMATIC Logon V1.6 and updated SIMATIC Logon V2.0 and SIMOTION OACAMGEN to 'No Fix Planned'

  3. #4

    Updated remediation for AI Lightweight Inference Server to no fix planned.

  4. #3

    Added RUGGEDCOM ROX II family and SIMATIC HMI Operator Device to Known Not Affected and removed SIMATIC Comfort/Mobile RT and updated SIMATIC Advanced HMI Panels and SIMATIC HMI Basic Panels to no fix available; Added fix for SIMATIC PDM V9.3 and added PCS neo V6.0 and Simatic Logon to affected products.

  5. #2

    Added SCALANCE X-200 family, X-200IRT family, X-200RNA family, X-300/408 family, SC-600 family to Known Not Affected and fix for SINUMERIK Access MyMachine /OPC UA , SIMOVE Fleetmanager. Updated remediation to No fix planned for SIMATIC Comfort/Mobile RT

  6. #1

    Publication Date

References