Skip to content
OpenAdvisories
High SSA-712929 1 CVE

SSA-712929: Denial of Service Vulnerability in OpenSSL (CVE-2022-0778) Affecting Industrial Products

Published Jun 14, 2022 · Updated Apr 14, 2026 · Revision 22

Vendor: Siemens Product: Industrial Edge - OPC UA Connector Product: Industrial Edge - SIMATIC S7 Connector App Product: OpenPCS 7 V8.2 Product: OpenPCS 7 V9.0 Product: OpenPCS 7 V9.1 Product: RUGGEDCOM CROSSBOW Station Access Controller (SAC) Product: RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) Product: RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) Product: RUGGEDCOM ROX MX5000 Product: RUGGEDCOM ROX MX5000RE Product: RUGGEDCOM ROX RX1400 Product: RUGGEDCOM ROX RX1500 Product: RUGGEDCOM ROX RX1501 Product: RUGGEDCOM ROX RX1510 Product: RUGGEDCOM ROX RX1511 Product: RUGGEDCOM ROX RX1512 Product: RUGGEDCOM ROX RX1524 Product: RUGGEDCOM ROX RX1536 Product: RUGGEDCOM ROX RX5000 Product: SCALANCE LPE9403 (6GK5998-3GS00-2AC2) Product: SCALANCE M804PB (6GK5804-0AP00-2AA2) Product: SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) Product: SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) Product: SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) Product: SCALANCE M874-2 (6GK5874-2AA00-2AA2) Product: SCALANCE M874-3 (6GK5874-3AA00-2AA2) Product: SCALANCE M876-3 (6GK5876-3AA02-2BA2) +121 more

Summary

A vulnerability in the openSSL component (CVE-2022-0778, [0]) could allow an attacker to create a denial of service condition by providing specially crafted elliptic curve certificates to products that use a vulnerable version of openSSL.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

[0] https://www.openssl.org/news/secadv/20220315.txt

Vulnerabilities 1

  • High 7.5
    CVE-2022-0778 Public exploit EPSS 73%

    Infinite loop in BN_mod_sqrt() reachable when parsing certificates

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io

Revision history

  1. #22

    Added fix for SCALANCE W-700 IEEE 802.11n family

  2. #21

    Added fix for SIMATIC CP 1545-1; Updated several product names and expanded SIMATIC S7-1200 CPU family to individual products and MLFB IDs

  3. #20

    Adjusted Totally Integrated Automation Portal (TIA Portal) entries and clarified that no fix is planned for SCALANCE W-1700 IEEE 802.11ac family

  4. #19

    Added fix for SCALANCE X-300 family (incl. X408 and SIPLUS NET variants)

  5. #18

    Expanded SIMATIC WinCC family to individual version lines; SIMATIC PCS 7 V9.1: clarified that V9.1 SP2 UC04 fixes the issue in SIMATIC WinCC

  6. #17

    Added fix for SIMATIC CP 1543-1 (incl. SIPLUS variants); Updated fix for TIM 1531 IRC (incl. SIPLUS NET variants)

  7. #16

    Added fix for SIMATIC PCS 7 TeleControl; Clarified that no fix is planned for SINAUT Software ST7sc and SINAUT ST7CC

  8. #15

    Added fix for SIMATIC CP 1242-7 V2 family, SIMATIC CP 1243-1 family, SIMATIC CP 1243-7 LTE family, SIMATIC CP 1243-8 IRC and for SIMATIC NET PC Software V17

  9. #14

    Clarified SIMATIC S7-1500 Software Controller versions and adjusted fix for SIMATIC S7-1500 Software Controller V2; Clarified SIMATIC ET 200SP Open Controller versions and added fix for SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

  10. #13

    Expanded SIMATIC S7-1500 CPU family to individual products/MLFBs and added additional fix for V2 firmware version line; Fix for SIMATIC Drive Controller available already with V2.9.7

  11. #12

    Added fix for SIMOTION; clarified that no fix is planned for V8.2, V9.0, V9.1 of OpenPCS 7 and for V8.2, V9.0 of SIMATIC PCS 7; added fix and mitigation information for SIMATIC PCS 7 V9.1

  12. #11

    Added fix for SIMATIC S7-1500 Software Controller; fix planned for SIMATIC NET PC Software V17

  13. #10

    Added fix for SCALANCE X-200IRT family, SIMATIC CP 443-1 Advanced, TIM 1531 IRC, SCALANCE XB-200, XC-200, XP-200, XF-200BA, XR-300WG family, and for SIMATIC WinCC

  14. #9

    Added fix for SIMATIC CP 1542SP-1 and SIMATIC CP 1543SP-1, RUGGEDCOM RM1224 family, SCALANCE M-800 family, SCALANCE MUM-800 family, SCALANCE S615. Added missing affected products SCALANCE M876-4 (6GK5876-4AA10-2BA2) and SCALANCE S615 EEC (6GK5615-0AA01- 2AA2)

  15. #8

    Added fix for SCALANCE W1750D product family

  16. #7

    Added fix for SCALANCE W-700 IEEE 802.11ax product family

  17. #6

    Added SIMATIC Process Historian and SIMATIC HMI Unified Comfort Panels; added fix for SIMATIC PCS neo, SIMATIC Drive Controller family, SIMATIC S7-PLCSIM Advanced, SIMATIC S7-1500 and S7-1200 CPU families, and TIA Administrator; no fix planned for TIA Portal V16

  18. #5

    Added fix for SIMATIC WinCC Unified, TIA Portal V17, and SINEC NMS; added SCALANCE W-700 and W-1700 product families as affected; corrected several product names in the SCALANCE XB and XP product families

  19. #4

    Added fix for RUGGEDCOM CROSSBOW Station Access Controller (SAC), SCALANCE XM-400 and XR-500 product families, and SINEC INS

  20. #3

    Added fix for Industrial Edge - OPC UA Connector, SIMATIC Cloud Connect 7 gateways, SIMATIC Logon, SIMATIC PDM, SIMATIC STEP 7 V5.X and TeleControl Server Basic; added SCALANCE W1750D as affected; clarified that Industrial Edge - PROFINET IO Connector is not affected

  21. #2

    Added SCALANCE X-200, X-200 IRT, X-300, XM-400, XR-500, XR-300WG, XB-200, XC-200, XF-200, XP-200 product families and Security Configuration Tool (SCT) as affected; added fix for RUGGEDCOM ROX devices and SIMATIC MV500 devices; no fix planned for SIMATIC NET PC Software, SIMATIC CP 343-1 Advanced and SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variants)

  22. #1

    Publication Date

References