Skip to content
OpenAdvisories
Medium SSA-628843 1 CVE

SSA-628843: Out of Bound Read Vulnerability in TPM 2.0

Published Apr 14, 2026 · Updated Oct 13, 2026 · Revision 3

Vendor: Siemens Product: SIMATIC CN 4100 Product: SIMATIC Field PG M5 Product: SIMATIC Field PG M6 Product: SIMATIC IPC BX-32A Product: SIMATIC IPC BX-39A Product: SIMATIC IPC BX-56A Product: SIMATIC IPC BX-59A Product: SIMATIC IPC MD-57A Product: SIMATIC IPC PX-32A Product: SIMATIC IPC PX-39A Product: SIMATIC IPC PX-39A PRO Product: SIMATIC IPC RW-528A Product: SIMATIC IPC RW-548A Product: SIMATIC IPC227E Product: SIMATIC IPC277E Product: SIMATIC IPC427E Product: SIMATIC IPC477E Product: SIMATIC IPC477E PRO Product: SIMATIC IPC627E Product: SIMATIC IPC647E Product: SIMATIC IPC677E Product: SIMATIC IPC847E Product: SIMATIC ITP1000 Product: SIPLUS IPC427E

Summary

The products listed below contain a vulnerability that could allow an attacker to perform an out-of-bound read, potentially leading to information disclosure or denial of service of the TPM.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

  • Medium 6.6
    CVE-2025-2884

    Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation

    TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TP…

    Trusted Computing Group TPM2.0

Revision history

  1. #3

    Added fix for SIMATIC IPC627E / IPC647E / IPC677E / IPC847E

  2. #2

    Added no fix planned for SIMATIC ITP1000 and for SIMATIC Field PG M5. Added fix for SIMATIC Field PG M6

  3. #1

    Publication Date

References