A pre-authentication stack-based overflow in OpenSSL’s CMS parsing logic carries a CVSS 9.8 rating and touches Siemens networking, HMI, drive, and industrial software products spanning critical infrastructure sectors worldwide.
Summary
- CVE-2025-15467 is a stack buffer overflow in OpenSSL triggered by parsing a maliciously crafted CMS AuthEnvelopedData message with an oversized initialisation vector.
- The overflow occurs before any authentication or tag verification, meaning no valid key material is required to trigger it.
- CVSS base score is 9.8 Critical; potential impact ranges from denial of service to remote code execution depending on platform mitigations.
- More than 130 distinct Siemens products are listed as affected, including SCALANCE routers and switches, SIMATIC HMI panels, WinCC SCADA, SINAMICS drives, and RUGGEDCOM devices.
- Patches are available for a subset of products; several have no fix planned or available, leaving interim mitigations as the only near-term control.
What the vulnerability is
CVE-2025-15467 is a stack-based out-of-bounds write in OpenSSL versions 3.0, 3.3, 3.4, 3.5, and 3.6. When an application parses a CMS AuthEnvelopedData structure that uses an AEAD cipher such as AES-GCM, the initialisation vector encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without a length check. An attacker who can supply a crafted CMS or PKCS#7 message with an oversized IV can trigger the overflow. Critically, this happens before any authentication or tag verification takes place, so the attacker does not need access to valid key material. OpenSSL 1.1.1 and 1.0.2 are not affected, and the OpenSSL FIPS module boundaries exclude the CMS implementation, so FIPS configurations in the affected version lines are also not impacted by this specific issue.
The scope of Siemens exposure
Siemens ProductCERT reported the issue to CISA, which republished the advisory on 23 June 2026. The affected product list is extensive. Industrial networking hardware — including the full SCALANCE M, MUM, MUB, WAM, WAB, WUM, WUB, XC, and XR families, RUGGEDCOM LTE routers, and SCALANCE SC security appliances — is affected across all firmware versions with no fix currently available for most variants. On the software and HMI side, SIMATIC WinCC V7.5, V8.0, and V8.1 carry a similar ‘no fix available’ status, as do SIMATIC HMI Basic, Comfort, and Mobile Panels below version 17.0.9, multiple SIMATIC IPC models, SINAMICS drive firmware lines from version 6.3 onward, and various edge and IoT components including SIMATIC IOT2050 and the AI Lightweight Inference Server. The advisory notes critical infrastructure sectors potentially at risk include critical manufacturing, transportation, energy, healthcare, financial services, and government facilities.
Patches where they exist
Siemens has released fixes for a number of products. SIMATIC HMI panels (Basic, Comfort, Mobile) and WinCC Runtime Advanced are addressed in version 17 Update 9. WinCC OA patches are available at V3.19 P024, V3.20 P012, and V3.21 P02 respectively. SIMATIC STEP 7 V5 is remediated from version 5.7 SP4. SINEC INS is addressed from V1.0.2.5, the Connector for Azure from V1.8.0, Databus from V3.3.2, and the User Management Component from V2.15.3.0. WinCC Unified Sequence requires an update to V21. For products such as SIPLANT, customers are directed to contact Siemens customer support directly. Siemens states it is preparing further fix versions for products not yet remediated.
Where no fix is currently available
A significant portion of the affected product list carries either a ‘no fix planned’ or ‘currently no fix available’ status. This includes the bulk of the SCALANCE networking estate, RUGGEDCOM LTE routers, SIMATIC WinCC V7.5 through V8.1, several SIMATIC IPC variants, SINAMICS drive families, SIMOVE Fleetmanager, SINEC NMS, SINEC Security Monitor, HiMed Cockpit, and others. For these products, Siemens and CISA recommend interim mitigations rather than patching.
Why it matters
The combination of a CVSS 9.8 score, pre-authentication exploitability, and a product footprint that spans OT networking, industrial control, drive, and SCADA software makes this a high-priority item for any organisation running Siemens technology. The attack surface is not theoretical: any service on an affected product that accepts or processes CMS or PKCS#7 content — including S/MIME email handling and encrypted messaging workflows — could be reached by a crafted payload before the system has any opportunity to authenticate or reject the sender. For OT environments where patching cycles are long and network segmentation varies, the risk of a remotely triggered crash or worse on a device such as a SCALANCE router or SIMATIC HMI panel warrants immediate inventory and exposure assessment.
What to do now
- Identify all Siemens products in your environment and cross-reference them against the full affected product list in CISA advisory SSA-434797; pay particular attention to any products listed as ‘all versions affected’.
- Apply available patches where products are eligible: update HMI panels and WinCC Runtime Advanced to V17 Update 9, WinCC OA to the relevant P-patch level, STEP 7 V5 to SP4, SINEC INS to V1.0.2.5, and other patchable products to their specified remediated versions.
- For products without an available fix, restrict network access so affected devices cannot receive untrusted CMS or PKCS#7 content from external sources.
- Do not accept files from untrusted or unvalidated sources in affected applications.
- Harden connected email infrastructure by enforcing TLS/SSL for all SMTP connections, restricting access to trusted systems only, requiring strong authentication, and keeping mail server software patched.
- Isolate affected control system networks behind firewalls and separate them from business networks; where remote access is necessary, use a VPN kept at its latest available version.
- Follow Siemens’ operational guidelines for industrial security and review product-specific hardening instructions in relevant product manuals.
- Monitor CISA and Siemens ProductCERT channels for updated fix availability as Siemens continues to prepare patches for currently unremediated products.
