Skip to content
Fencer Vulns
high 7.5

CVE-2022-0778 in the critical feed json

Infinite loop in BN_mod_sqrt() reachable when parsing certificates

published 2022-03-15 4 y ago modified 2026-10-16 23 d ago also BIT-mariadb-2022-0778 , BIT-mariadb-min-2022-0778 , BIT-mysql-client-2022-0778 , BIT-node-2022-0778 , BIT-node-min-2022-0778 , EUVD-2022-1575 , GHSA-x3mh-jvjw-3xwx , JLSEC-2026-227 , RUSTSEC-2022-0014

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
73.2%
EPSS 73.2% chance of exploitation in 30 days, percentile 99.4%
public exploits
0
none known

Summary

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Patch / fix

  • crates.io openssl-src 111.18.0, 300.0.5
  • bitnami mariadb 10.2.42, 10.3.33, 10.4.23, 10.5.14, 10.6.6, 10.7.2
  • bitnami mariadb-min 10.2.42, 10.3.33, 10.4.23, 10.5.14, 10.6.6, 10.7.2
  • bitnami mysql-client 10.2.42, 10.3.33, 10.4.23, 10.5.14, 10.6.6, 10.7.2
  • bitnami node 12.12.1, 12.22.11, 14.14.1, 14.19.1, 16.12.1, 16.14.2, 17.7.2
  • bitnami node-min 12.12.1, 12.22.11, 14.14.1, 14.19.1, 16.12.1, 16.14.2, 17.7.2
  • julia OpenSSL_jll 1.1.14+0
  • julia Openresty_jll 1.21.4+0
  • julia libnode_jll 16.17.0+0
  • Siemens BFCClient V2.17
  • Siemens Industrial Edge - OPC UA Connector V1.7.0.0
  • Siemens Industrial Edge - SIMATIC S7 Connector App V1.7.0.0
  • Siemens RUGGEDCOM RM1224 LTE(4G) EU V7.2
  • Siemens RUGGEDCOM RM1224 LTE(4G) NAM V7.2
  • Siemens RUGGEDCOM ROX MX5000 V2.15.1
  • Siemens RUGGEDCOM ROX MX5000RE V2.15.1
  • Siemens RUGGEDCOM ROX RX1400 V2.15.1
  • Siemens RUGGEDCOM ROX RX1500 V2.15.1
  • Siemens RUGGEDCOM ROX RX1501 V2.15.1
  • Siemens RUGGEDCOM ROX RX1510 V2.15.1
  • Siemens RUGGEDCOM ROX RX1511 V2.15.1
  • Siemens RUGGEDCOM ROX RX1512 V2.15.1
  • Siemens RUGGEDCOM ROX RX1524 V2.15.1
  • Siemens RUGGEDCOM ROX RX1536 V2.15.1
  • Siemens RUGGEDCOM ROX RX5000 V2.15.1
  • Siemens SCALANCE LPE9403 V2.0 HF0
  • Siemens SCALANCE M804PB V7.2
  • Siemens SCALANCE M812-1 ADSL-Router V7.2
  • Siemens SCALANCE M816-1 ADSL-Router V7.2
  • Siemens SCALANCE M826-2 SHDSL-Router V7.2
  • openssl Debian 14, Debian 13, Debian 12 1.1.1n-1

debian advisories DEBIAN-CVE-2022-0778

  • edk2 Ubuntu 22.04 LTS 2022.02-3ubuntu0.22.04.4
  • nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.1
  • openssl Ubuntu 18.04 LTS 1.1.1-1ubuntu2.1~18.04.15
  • openssl Ubuntu 20.04 LTS 1.1.1f-1ubuntu2.12
  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1
  • openssl1.0 Ubuntu 18.04 LTS 1.0.2n-1ubuntu5.8
  • openssl Ubuntu Pro 14.04 LTS 1.0.1f-1ubuntu2.27+esm5
  • openssl Ubuntu Pro 16.04 LTS 1.0.2g-1ubuntu4.20+esm2

ubuntu advisories UBUNTU-CVE-2022-0778

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • compat-openssl10 RHEL 8 1:1.0.2o-4.el8_6
  • compat-openssl11 RHEL 9 1:1.1.1k-4.el9_0
  • redhat-virtualization-host rhev hypervisor 4.4 4.5.0-202205291010_8.6
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.5.0-202205291010_8.6
  • jws5-tomcat jboss enterprise web server 5.6 9.0.50-5.redhat_00007.1.el7jws
  • jws5-tomcat jboss enterprise web server 5.6 9.0.50-5.redhat_00007.1.el8jws
  • jws5-tomcat-lib jboss enterprise web server 5.6 9.0.50-5.redhat_00007.1.el7jws
  • jws5-tomcat-lib jboss enterprise web server 5.6 9.0.50-5.redhat_00007.1.el8jws

red hat advisories RHSA-2022:5326RHSA-2022:4899RHSA-2022:1091RHSA-2022:4896RHSA-2022:1082RHSA-2022:1519

  • nodejs14 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 14.19.1-150200.15.31.1
  • nodejs12 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 12.22.12-150200.4.32.1
  • nodejs14 SLE Module for Web and Scripting 12 14.19.1-6.28.1
  • openssl-1_1 SLES 15 SP2-BCL, SLE Real Time 15 SP2, SLE Module for Basesystem 15 SP3 +11 more 1.1.1d-11.43.1
  • zlib SLES 15 SP2-BCL, SLES 15 SP1-BCL, SLE Real Time 15 SP2 +22 more 1.2.11-3.26.10
  • glibc SLE Module for Basesystem 15 SP3, SLE Micro 5.2, SLE Micro 5.1 2.31-150300.20.7
  • libxcrypt SLE Module for Development Tools 15 SP3, SLE Module for Basesystem 15 SP3, SLE Micro 5.2 +1 more 4.4.15-150300.4.2.41
  • nodejs12 SLE Module for Web and Scripting 12 12.22.11-1.45.1

suse advisories SUSE-SU-2022:1462-1SUSE-SU-2022:1461-1SUSE-SU-2022:1459-1SUSE-SU-2022:0861-1SUSE-SU-2022:0935-1SUSE-RU-2022:0861-1

  • python-ecdsa openSUSE Tumbleweed 0.19.1-1.1
  • openssl-3 openSUSE Tumbleweed 3.0.2-1.1
  • openssl-1_1 openSUSE Tumbleweed 1.1.1n-1.1
  • libressl openSUSE Tumbleweed 3.4.3-1.1
  • cargo-audit-advisory-db openSUSE Tumbleweed 20220323-1.1
  • python-ecdsa openSUSE Tumbleweed 0.18.0-1.1
  • openssl-1_0_0 openSUSE Leap 15.3 1.0.2p-3.49.1

opensuse advisories openSUSE-SU-2025:14965-1openSUSE-SU-2024:11927-1openSUSE-SU-2024:11933-1openSUSE-SU-2024:11944-1openSUSE-SU-2024:11953-1openSUSE-SU-2024:12444-1

  • compat-openssl10 AlmaLinux 8 1:1.0.2o-4.el8_6
  • openssl AlmaLinux 8 1:1.1.1k-6.el8_5
  • openssl-libs AlmaLinux 8 1:1.1.1k-6.el8_5
  • openssl-perl AlmaLinux 8 1:1.1.1k-6.el8_5

almalinux advisories ALSA-2022:5326ALSA-2022:1065

  • compat-openssl10 Rocky Linux 8 1:1.0.2o-4.el8_6
  • compat-openssl11 Rocky Linux 9 1:1.1.1k-4.el9_0
  • openssl Rocky Linux 8 1:1.1.1k-6.el8_5

rocky linux advisories RLSA-2022:5326RLSA-2022:4899RLSA-2022:1065

  • openssl Alpine 3.16, Alpine 3.15, Alpine 3.14 +2 more 1.1.1n-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.0.2-r0
  • libressl Alpine 3.14 3.3.6-r0
  • libressl Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 3.4.3-r0
  • libretls Alpine 3.14 3.3.3p1-r3
  • libretls Alpine 3.15 3.3.4-r3
  • libretls Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 3.5.1-r0
  • openssl3 Alpine 3.16, Alpine 3.15 3.0.2-r0

alpine advisories ALPINE-CVE-2022-0778

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl CBL-Mariner 2.0 1.1.1k-12

azure linux advisories AZL-9051

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0778 updated cvss 7.5

openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/management-ingress-rhel8
    affected: workaround, no fix available “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat JBoss Enterprise Application Platform 6 openssl Red Hat JBoss Web Server 3 openssl
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat Enterprise Linux AppStream (v. 8) compat-openssl10 1.0.2o-4.el8_6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:5326
  • Red Hat Enterprise Linux AppStream (v. 9) compat-openssl11 1.1.1k-4.el9_0
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:4899
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-6.el8_5, openssl-libs 1.1.1k-6.el8_5, openssl-perl 1.1.1k-6.el8_5
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1065
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) openssl 1.1.1c-5.el8_1.1, openssl-libs 1.1.1c-5.el8_1.1, openssl-perl 1.1.1c-5.el8_1.1
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1112
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) openssl 1.1.1c-19.el8_2, openssl-libs 1.1.1c-19.el8_2, openssl-perl 1.1.1c-19.el8_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1091
  • Red Hat Enterprise Linux BaseOS EUS (v.8.4) openssl 1.1.1g-16.el8_4, openssl-libs 1.1.1g-16.el8_4, openssl-perl 1.1.1g-16.el8_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1071
show 26 more
  • Red Hat Enterprise Linux Client (v. 7) openssl 1.0.2k-25.el7_9, openssl-libs 1.0.2k-25.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) openssl-perl 1.0.2k-25.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-perl 1.0.2k-25.el7_9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1066
  • Red Hat Enterprise Linux Server (v. 6 ELS) openssl 1.0.1e-60.el6_10
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1073
  • Red Hat Enterprise Linux Server (v. 7) openssl 1.0.2k-25.el7_9, openssl-libs 1.0.2k-25.el7_9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1066
  • Red Hat Enterprise Linux Server AUS (v. 7.3) openssl 1.0.1e-62.el7_3, openssl-libs 1.0.1e-62.el7_3
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1082
  • Red Hat Enterprise Linux Server AUS (v. 7.4) openssl 1.0.2k-10.el7_4, openssl-libs 1.0.2k-10.el7_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1076
  • Red Hat Enterprise Linux Server AUS (v. 7.6) openssl 1.0.2k-18.el7_6, openssl-libs 1.0.2k-18.el7_6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1078
  • Red Hat Enterprise Linux Server AUS (v. 7.7) openssl 1.0.2k-21.el7_7, openssl-libs 1.0.2k-21.el7_7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1077
  • Red Hat Enterprise Linux Server E4S (v. 7.6) openssl 1.0.2k-18.el7_6, openssl-libs 1.0.2k-18.el7_6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1078
  • Red Hat Enterprise Linux Server E4S (v. 7.7) openssl 1.0.2k-21.el7_7, openssl-libs 1.0.2k-21.el7_7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1077
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) openssl-perl 1.0.1e-60.el6_10
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1073
  • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.2k-25.el7_9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1066
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) openssl-perl 1.0.1e-62.el7_3
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1082
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) openssl-perl 1.0.2k-10.el7_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1076
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.6) openssl-perl 1.0.2k-18.el7_6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1078
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) openssl-perl 1.0.2k-21.el7_7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1077
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.6) openssl-perl 1.0.2k-18.el7_6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1078
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.7) openssl-perl 1.0.2k-21.el7_7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1077
  • Red Hat Enterprise Linux Server Optional TUS (v. 7.6) openssl-perl 1.0.2k-18.el7_6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1078
  • Red Hat Enterprise Linux Server Optional TUS (v. 7.7) openssl-perl 1.0.2k-21.el7_7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1077
  • Red Hat Enterprise Linux Server TUS (v. 7.6) openssl 1.0.2k-18.el7_6, openssl-libs 1.0.2k-18.el7_6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1078
  • Red Hat Enterprise Linux Server TUS (v. 7.7) openssl 1.0.2k-21.el7_7, openssl-libs 1.0.2k-21.el7_7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1077
  • Red Hat Enterprise Linux Workstation (v. 7) openssl 1.0.2k-25.el7_9, openssl-libs 1.0.2k-25.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.2k-25.el7_9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1066
  • Red Hat JBoss Core Services
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1390
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl 7.78.0-3.jbcs.el7, jbcs-httpd24-httpd 2.4.37-80.jbcs.el7, jbcs-httpd24-mod_md 2.0.8-41.jbcs.el7, jbcs-httpd24-libcurl 7.78.0-3.jbcs.el7, jbcs-httpd24-apr-util 1.6.1-91.jbcs.el7, jbcs-httpd24-mod_ssl 2.4.37-80.jbcs.el7, +25 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl 7.78.0-3.el8jbcs, jbcs-httpd24-httpd 2.4.37-80.el8jbcs, jbcs-httpd24-mod_md 2.0.8-41.el8jbcs, jbcs-httpd24-libcurl 7.78.0-3.el8jbcs, jbcs-httpd24-apr-util 1.6.1-91.el8jbcs, jbcs-httpd24-mod_ssl 2.4.37-80.el8jbcs, +25 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1389
  • Red Hat JBoss Web Server 5
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1520
  • Red Hat JBoss Web Server 5.6 for RHEL 7 Server jws5-tomcat 9.0.50-5.redhat_00007.1.el7jws, jws5-tomcat-native 1.2.30-4.redhat_4.el7jws, jws5-tomcat-lib 9.0.50-5.redhat_00007.1.el7jws, jws5-tomcat-javadoc 9.0.50-5.redhat_00007.1.el7jws, jws5-tomcat-selinux 9.0.50-5.redhat_00007.1.el7jws, jws5-tomcat-webapps 9.0.50-5.redhat_00007.1.el7jws, +7 more Red Hat JBoss Web Server 5.6 for RHEL 8 jws5-tomcat 9.0.50-5.redhat_00007.1.el8jws, jws5-tomcat-native 1.2.30-4.redhat_4.el8jws, jws5-tomcat-lib 9.0.50-5.redhat_00007.1.el8jws, jws5-tomcat-javadoc 9.0.50-5.redhat_00007.1.el8jws, jws5-tomcat-selinux 9.0.50-5.redhat_00007.1.el8jws, jws5-tomcat-webapps 9.0.50-5.redhat_00007.1.el8jws, +5 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:1519

3 more fixed, 7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-111-07 updated cvss 7.5

Siemens SCALANCE

  • Siemens SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) < 6.6.0 Siemens SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) < 6.6.0 Siemens SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0) < 6.6.0 Siemens SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0) < 6.6.0 Siemens SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0) < 6.6.0 Siemens SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0) < 6.6.0
    +34 more products
    Siemens SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6) < 6.6.0 Siemens SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0) < 6.6.0 Siemens SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6) < 6.6.0 Siemens SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0) < 6.6.0 Siemens SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0) < 6.6.0 Siemens SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0) < 6.6.0 Siemens SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0) < 6.6.0 Siemens SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0) < 6.6.0 Siemens SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0) < 6.6.0 Siemens SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0) < 6.6.0 Siemens SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0) < 6.6.0 Siemens SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0) < 6.6.0 Siemens SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0) < 6.6.0 Siemens SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0) < 6.6.0 Siemens SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6) < 6.6.0 Siemens SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0) < 6.6.0 Siemens SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0) < 6.6.0 Siemens SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6) < 6.6.0 Siemens SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0) < 6.6.0 Siemens SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0) < 6.6.0 Siemens SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0) < 6.6.0 Siemens SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0) < 6.6.0 Siemens SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0) < 6.6.0 Siemens SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AB0) < 6.6.0 Siemens SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AA0) < 6.6.0 Siemens SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AB0) < 6.6.0 Siemens SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AC0) < 6.6.0 Siemens SCALANCE W786-2 SFP (6GK5786-2FE00-0AA0) < 6.6.0 Siemens SCALANCE W786-2 SFP (6GK5786-2FE00-0AB0) < 6.6.0 Siemens SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AA0) < 6.6.0 Siemens SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AB0) < 6.6.0 Siemens SCALANCE W788-1 M12 (6GK5788-1GD00-0AA0) < 6.6.0 Siemens SCALANCE W788-1 M12 (6GK5788-1GD00-0AB0) < 6.6.0 Siemens SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AA0) < 6.6.0
    affected: fixed in V6.6.0 support.industry.siemens.com

9 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-167-14 updated cvss 7.5

Siemens OpenSSL Affected Industrial Products

  • Siemens Industrial Edge - OPC UA Connector <V1.7 Siemens Industrial Edge - SIMATIC S7 Connector App <V1.7
    affected: fixed in V1.7 siemens.com
  • Siemens OpenPCS 7 V8.2 Siemens OpenPCS 7 V9.0 Siemens OpenPCS 7 V9.1
    affected: mitigation, no fix planned
  • Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) only_when_running_on_ROX_II_<V2.15.1
    affected: fixed in V2.15.1 support.industry.siemens.com
  • Siemens RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) < 7.2 Siemens RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) < 7.2
    affected: fixed in V7.2 support.industry.siemens.com
  • Siemens RUGGEDCOM ROX MX5000 < 2.15.1 Siemens RUGGEDCOM ROX MX5000RE < 2.15.1 Siemens RUGGEDCOM ROX RX1400 < 2.15.1 Siemens RUGGEDCOM ROX RX1500 < 2.15.1 Siemens RUGGEDCOM ROX RX1501 < 2.15.1 Siemens RUGGEDCOM ROX RX1510 < 2.15.1
    +5 more products
    Siemens RUGGEDCOM ROX RX1511 < 2.15.1 Siemens RUGGEDCOM ROX RX1512 < 2.15.1 Siemens RUGGEDCOM ROX RX1524 < 2.15.1 Siemens RUGGEDCOM ROX RX1536 < 2.15.1 Siemens RUGGEDCOM ROX RX5000 < 2.15.1
    affected: fixed in V2.15.1 support.industry.siemens.com
  • Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2) <V2.0
    affected: fixed in V2.0 support.industry.siemens.com
  • Siemens SCALANCE M804PB (6GK5804-0AP00-2AA2) < 7.2 Siemens SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) < 7.2 Siemens SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) < 7.2 Siemens SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) < 7.2 Siemens SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) < 7.2 Siemens SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) < 7.2
    +12 more products
    Siemens SCALANCE M874-2 (6GK5874-2AA00-2AA2) < 7.2 Siemens SCALANCE M874-3 (6GK5874-3AA00-2AA2) < 7.2 Siemens SCALANCE M876-3 (6GK5876-3AA02-2BA2) < 7.2 Siemens SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) < 7.2 Siemens SCALANCE M876-4 (6GK5876-4AA10-2BA2) < 7.2 Siemens SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) < 7.2 Siemens SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) < 7.2 Siemens SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) < 7.2 Siemens SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) < 7.2 Siemens SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) < 7.2 Siemens SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) < 7.2 Siemens SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) < 7.2
    affected: fixed in V7.2 support.industry.siemens.com
  • Siemens SCALANCE SC622-2C (6GK5622-2GS00-2AC2) <V2.3.1 Siemens SCALANCE SC632-2C (6GK5632-2GS00-2AC2) <V2.3.1
    affected: fixed in V2.3.1 support.industry.siemens.com

545 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-348-10 updated cvss 7.5

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-226-21 updated cvss 7.5

Siemens BFCClient

  • Siemens BFCClient < 2.17
    affected: fixed in V2.17

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-046-02 updated cvss 7.5

Siemens SIDIS Prime

  • Siemens SIDIS Prime <V4.0.400
    affected: fixed in V4.0.400

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-143-02 updated cvss 7.5

Hitachi Energy's RTU500 Series Product (UPDATE B)

  • Hitachi Energy RTU500 series CMU Firmware >=12.0.1, <=12.0.15, >=12.2.1, <=12.2.12, >=12.4.1, <=12.4.12, >=12.6.1, <=12.6.9
    affected: vendor fix, mitigation “Hitachi Energy has released the following mitigations/fixes for CVE-2022-23937, CVE-2022-0778, CVE-2021-3711, and CVE-2021-3712:” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-059-01 updated cvss 7.5

Hitachi Energy Gateway Station

  • Hitachi Energy Gateway Station (GWS) 2.0.0.0, 2.1.0.0, 2.2.0.0, 2.3.0.0
    affected: vendor fix search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-22-221-01 updated cvss 7.5

Mitsubishi Electric Multiple Factory Automation Products (Update B)

  • Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch (NZ2MHG-TSNT8F2 NZ2MHG-TSNT4) <= 03 Mitsubishi Electric GOT2000 compatible HMI software (GT SoftGOT2000) 1.275M Mitsubishi Electric MELSEC iQ-R Series OPC UA Server Module (RD81OPC96) <= 08
    affected: mitigation “For instructions on how to check the product version and more information regarding contacting Mitsubishi Electric, refer to Mitsubishi Electric's security advisory.” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-22-272-02 updated cvss 7.5

Hitachi Energy MicroSCADA Pro X SYS600

  • Hitachi Energy SYS600 9.x, <= 10.3.1
    affected: vendor fix, mitigation “Hitachi Energy recommends following 1MRK511518 MicroSCADA X Cyber Security Deployment Guidelines.” hitachienergy.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-22-132-02 updated cvss 7.5

Mitsubishi Electric MELSOFT iQ AppPortal

  • Mitsubishi Electric MELSOFT iQ AppPortal (SW1DND-IQAPL-M) >= 1.00A, <= 1.26C
    affected: mitigation “Update to 1.29F or later. Unzip the downloaded file (zip format) and execute the file “setup.exe.”” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

73.19% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io openssl-src
>=300.0.0, <300.0.5
<111.18.0
>=0.0.0-0, <111.18.0
300.0.5
111.18.0
bitnami mariadb
>=10.2.0, <10.2.42
>=10.3.0, <10.3.33
>=10.4.0, <10.4.23
>=10.5.0, <10.5.14
>=10.6.0, <10.6.6
>=10.7.0, <10.7.2
10.2.42
10.3.33
10.4.23
10.5.14
10.6.6
10.7.2
bitnami mariadb-min
>=10.2.0, <10.2.42
>=10.3.0, <10.3.33
>=10.4.0, <10.4.23
>=10.5.0, <10.5.14
>=10.6.0, <10.6.6
>=10.7.0, <10.7.2
10.2.42
10.3.33
10.4.23
10.5.14
10.6.6
10.7.2
bitnami mysql-client
>=10.2.0, <10.2.42
>=10.3.0, <10.3.33
>=10.4.0, <10.4.23
>=10.5.0, <10.5.14
>=10.6.0, <10.6.6
>=10.7.0, <10.7.2
10.2.42
10.3.33
10.4.23
10.5.14
10.6.6
10.7.2
bitnami node
>=12.0.0, <12.12.1
>=12.13.0, <12.22.11
>=14.0.0, <14.14.1
>=14.15.0, <14.19.1
>=16.0.0, <16.12.1
>=16.13.0, <16.14.2
>=17.0.0, <17.7.2
12.12.1
12.22.11
14.14.1
14.19.1
16.12.1
16.14.2
17.7.2
bitnami node-min
>=12.0.0, <12.12.1
>=12.13.0, <12.22.11
>=14.0.0, <14.14.1
>=14.15.0, <14.19.1
>=16.0.0, <16.12.1
>=16.13.0, <16.14.2
>=17.0.0, <17.7.2
12.12.1
12.22.11
14.14.1
14.19.1
16.12.1
16.14.2
17.7.2
julia OpenSSL_jll
<1.1.14+0
1.1.14+0
julia Openresty_jll
<1.21.4+0
1.21.4+0
julia libnode_jll
<16.17.0+0
16.17.0+0

Affected products

  • OpenSSL OpenSSL
  • Siemens BFCClient
  • Siemens Industrial Edge - OPC UA Connector
  • Siemens Industrial Edge - SIMATIC S7 Connector App
  • Siemens OpenPCS 7 V8.2
  • Siemens OpenPCS 7 V9.0
  • Siemens OpenPCS 7 V9.1
  • Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC)
  • Siemens RUGGEDCOM RM1224 LTE(4G) EU
  • Siemens RUGGEDCOM RM1224 LTE(4G) NAM
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000
  • Siemens SCALANCE LPE9403
  • Siemens SCALANCE M804PB
  • Siemens SCALANCE M812-1 ADSL-Router
  • Siemens SCALANCE M816-1 ADSL-Router
  • Siemens SCALANCE M826-2 SHDSL-Router
  • Siemens SCALANCE M874-2
  • Siemens SCALANCE M874-3
  • Siemens SCALANCE M876-3
  • Siemens SCALANCE M876-3 (ROK)
  • Siemens SCALANCE M876-4
  • Siemens SCALANCE M876-4 (EU)
  • Siemens SCALANCE M876-4 (NAM)
  • Siemens SCALANCE MUM853-1 (EU)
  • Siemens SCALANCE MUM856-1 (EU)
  • Siemens SCALANCE MUM856-1 (RoW)
  • Siemens SCALANCE S615 EEC LAN-Router
  • Siemens SCALANCE S615 LAN-Router
  • Siemens SCALANCE SC622-2C
  • Siemens SCALANCE SC632-2C
  • Siemens SCALANCE SC636-2C
  • Siemens SCALANCE SC642-2C
  • Siemens SCALANCE SC646-2C
  • Siemens SCALANCE W1748-1 M12
  • Siemens SCALANCE W1750D (JP)
  • Siemens SCALANCE W1750D (ROW)
  • Siemens SCALANCE W1750D (USA)
  • Siemens SCALANCE W1788-1 M12
  • Siemens SCALANCE W1788-2 EEC M12
  • Siemens SCALANCE W1788-2 M12

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.