Full Report
OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Analysis Summary
# Vulnerability: OpenSSL Stack-Based Buffer Overflow in Siemens Products
## CVE Details
- **CVE ID:** CVE-2025-15467
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-787: Out-of-bounds Write
## Affected Systems
- **Products:** Various Siemens industrial and networking products including:
- AI Lightweight Inference Server
- Connector for Azure
- Siemens OPC UA Modelling Editor (SiOME)
- SIMATIC Comfort/Mobile RT, HMI Comfort Panels, eaSie Core/PCS 7 Packages
- SINAMICS G220, S200, S210, S220
- SINEC INS, NMS, Security Monitor
- **Versions:**
- Specific versions vary by product (e.g., Connector for Azure <= V4.0.700; SINEC INS < V1.0 SP2 Update 5; SINAMICS >= V6.3).
- Generally impacts Siemens products utilizing OpenSSL versions 3.0, 3.3, 3.4, 3.5, and 3.6.
- **Configurations:** Systems parsing untrusted CMS (Cryptographic Message Syntax) or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM).
## Vulnerability Description
The vulnerability is a stack-based buffer overflow occurring during the parsing of CMS `AuthEnvelopedData` messages. When processing AEAD parameters (such as AES-GCM), the Initialization Vector (IV) length provided in the ASN.1 parameters is not validated against the destination fixed-size stack buffer. This allows an attacker to perform an out-of-bounds write. Crucially, this overflow occurs **before** any authentication or tag verification, meaning an attacker does not need valid credentials or key material to trigger the flaw.
## Exploitation
- **Status:** PoC availability and "in the wild" exploitation status not explicitly confirmed in the advisory, but the technical primitive is well-defined.
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High (Denial of Service via application crash or potential Remote Code Execution).
## Remediation
### Patches
- **SINEC INS:** Update to V1.0 SP2 Update 5 or later.
- **SIMOVE Fleetmanager:** Fix available (refer to Siemens portal).
- **SINUMERIK Access MyMachine /OPC UA:** Fix available (refer to Siemens portal).
- **Other Products:** Many products (e.g., SINAMICS, SiOME, AI Server) currently have no fix available; users should monitor the Siemens ProductCERT for updates.
### Workarounds
- **SIMATIC Comfort/Mobile RT:** No fix is planned; users must apply general mitigations.
- **General Recommendations:**
- Limit access to affected devices to trusted users and networks only.
- Use firewalls and VLANs to isolate industrial networks from the business network.
- Implement a "Defense in Depth" security concept.
## Detection
- **Indicators of Compromise:** Unusual application crashes in services handling S/MIME or encrypted CMS messages.
- **Detection methods:** Network-based Deep Packet Inspection (DPI) to identify oversized IV parameters in ASN.1 encoded CMS structures.
## References
- **Vendor Advisory:** hxxps://cert-portal[.]siemens[.]com/productcert/html/ssa-434797[.]html
- **Siemens ProductCERT:** hxxps://www[.]siemens[.]com/cert/advisories
- **OpenSSL Project:** hxxps://www[.]openssl[.]org/news/vuls[.]html