Skip to content
Fencer Vulns
high 7.4

CVE-2023-0286 in the critical feed json

X.400 address type confusion in X.509 GeneralName

published 2023-02-07 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-0817 , GHSA-x4qr-2fvf-3mr5 , JLSEC-2026-234 , PYSEC-2026-800 , RUSTSEC-2023-0006

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
69.3%
EPSS 69.3% chance of exploitation in 30 days, percentile 99.3%
public exploits
0
none known

Summary

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Patch / fix

  • pypi cryptography 39.0.1
  • crates.io openssl-src 111.25.0, 300.0.12
  • julia OpenSSL_jll 1.1.20+0
  • julia Openresty_jll 1.27.1+0
  • OpenSSL OpenSSL 1.0.2zg, 1.1.1t, 3.0.8
  • Siemens BFCClient V2.17
  • Siemens SCALANCE W1750D (JP) V8.10.0.9
  • Siemens SCALANCE W1750D (ROW) V8.10.0.9
  • Siemens SCALANCE W1750D (USA) V8.10.0.9
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • openssl Debian 14, Debian 13, Debian 12 3.0.8-1

debian advisories DEBIAN-CVE-2023-0286

  • edk2 Ubuntu 22.04 LTS 2022.02-3ubuntu0.22.04.4
  • nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.3
  • openssl Ubuntu 18.04 LTS 1.1.1-1ubuntu2.1~18.04.21
  • openssl Ubuntu 20.04 LTS 1.1.1f-1ubuntu2.17
  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.8
  • openssl1.0 Ubuntu 18.04 LTS 1.0.2n-1ubuntu5.11
  • openssl Ubuntu Pro 14.04 LTS 1.0.1f-1ubuntu2.27+esm6
  • openssl Ubuntu Pro 16.04 LTS 1.0.2g-1ubuntu4.20+esm6

ubuntu advisories UBUNTU-CVE-2023-0286

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.5.3-202309130206_8.6
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.5.3-202309130206_8.6
  • edk2 RHEL 8 20220126gitbb1bba3d77-4.el8
  • edk2-ovmf RHEL 8 20220126gitbb1bba3d77-4.el8
  • edk2-aarch64 RHEL 8 20220126gitbb1bba3d77-4.el8
  • compat-openssl11 RHEL 9 1:1.1.1k-5.el9_6.1
  • compat-openssl10 RHEL 8 1:1.0.2o-4.el8_10.1
  • openssl RHEL 9 1:3.0.1-47.el9_1

red hat advisories RHSA-2023:5209RHSA-2023:2932RHSA-2023:2022RHSA-2025:7937RHSA-2025:7895RHSA-2025:7733

  • openssl SLES 12 SP2-BCL 1.0.2j-60.86.1
  • openssl-1_1-livepatches SLE Live Patching 15 SP4, openSUSE Leap 15.4 0.1-150400.3.3.1
  • openssl-3 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.0.1-150400.4.17.1
  • openssl-1_1 SLE Module for Basesystem 15 SP4, SLE Micro 5.3, openSUSE Leap Micro 5.3 +1 more 1.1.1l-150400.7.22.1
  • openssl-1_1 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +13 more 1.1.1d-150200.11.57.1
  • openssl-1_1 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.1.1d-2.75.1
  • openssl-1_0_0 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.0.2p-3.64.1
  • openssl-1_0_0 SLE Module for Legacy 15 SP4, SLE High Performance Computing 15 SP3-ESPOS, openSUSE Leap 15.4 +9 more 1.0.2p-150000.3.65.1

suse advisories SUSE-SU-2023:0684-1SUSE-SU-2023:0482-1SUSE-SU-2023:0312-1SUSE-SU-2023:0311-1SUSE-SU-2023:0310-1SUSE-SU-2023:0309-1

  • rubygem-grpc openSUSE Tumbleweed 1.70.1-1.7
  • python315 openSUSE Tumbleweed 3.15.0~a1-1.1
  • rubygem-grpc openSUSE Tumbleweed 1.70.1-1.1
  • python314 openSUSE Tumbleweed 3.14.0~a1-1.1
  • python313 openSUSE Tumbleweed 3.13.0~b3-1.1
  • openssl-1_0_0 openSUSE Tumbleweed 1.0.2u-12.1
  • openssl-1_1 openSUSE Tumbleweed 1.1.1t-1.1
  • openssl-3 openSUSE Tumbleweed 3.0.8-1.1

opensuse advisories openSUSE-SU-2026:10348-1openSUSE-SU-2025:15713-1openSUSE-SU-2025:14821-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14109-1openSUSE-SU-2024:12687-1

  • compat-openssl10 AlmaLinux 8 1:1.0.2o-4.el8_10.1
  • compat-openssl11 AlmaLinux 9 1:1.1.1k-5.el9_6.1
  • edk2-ovmf AlmaLinux 8 20220126gitbb1bba3d77-4.el8
  • edk2-aarch64 AlmaLinux 8 20220126gitbb1bba3d77-4.el8
  • edk2-ovmf AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-tools AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-aarch64 AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • openssl AlmaLinux 8 1:1.1.1k-9.el8_7

almalinux advisories ALSA-2025:7895ALSA-2025:7937ALSA-2023:2932ALSA-2023:2165ALSA-2023:1405ALSA-2023:0946

  • compat-openssl11 Rocky Linux 9 1:1.1.1k-5.el9_6.1
  • compat-openssl10 Rocky Linux 8 1:1.0.2o-4.el8_10.1
  • openssl Rocky Linux 9 1:3.0.1-47.el9_1
  • openssl Rocky Linux 8 1:1.1.1k-9.el8_7

rocky linux advisories RLSA-2025:7937RLSA-2025:7895RLSA-2023:0946RLSA-2023:1405

  • openssl Alpine 3.16, Alpine 3.15, Alpine 3.14 1.1.1t-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.0.8-r0
  • openssl3 Alpine 3.16, Alpine 3.15 3.0.8-r0
  • openssl1.1-compat Alpine 3.18, Alpine 3.17 1.1.1t-r0

alpine advisories ALPINE-CVE-2023-0286

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl CBL-Mariner 2.0 1.1.1k-21
  • cloud-hypervisor CBL-Mariner 2.0 30.0-2
  • hvloader CBL-Mariner 2.0 1.0.1-2
  • hvloader Azure Linux 3.0 1.0.1-4

azure linux advisories AZL-13564AZL-13701AZL-37614AZL-37883

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-0286 updated cvss 7.4

openssl: X.400 address type confusion in X.509 GeneralName

  • Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Web Server 3 openssl
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat JBCS httpd 2.4.51.sp2
    fixed: vendor fix RHSA-2023:3355
  • Red Hat Enterprise Linux AppStream (v. 8) edk2 20220126gitbb1bba3d77-4.el8, compat-openssl10 1.0.2o-4.el8_10.1, edk2-ovmf 20220126gitbb1bba3d77-4.el8, edk2-aarch64 20220126gitbb1bba3d77-4.el8
    fixed: vendor fix RHSA-2025:7895
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.0.1-47.el9_1, compat-openssl11 1.1.1k-5.el9_6.1, edk2 20221207gitfff6d81270b5-9.el9_2, edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:0946
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) edk2 20190829git37eef91017ad-9.el8_2.2, edk2-ovmf 20190829git37eef91017ad-9.el8_2.2
    fixed: vendor fix RHSA-2023:4124
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) edk2 20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf 20200602gitca407c7246bf-4.el8_4.3
    fixed: vendor fix RHSA-2023:4252
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) edk2 20190829git37eef91017ad-9.el8_2.2, edk2-ovmf 20190829git37eef91017ad-9.el8_2.2
    fixed: vendor fix RHSA-2023:4124
show 27 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) edk2 20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf 20200602gitca407c7246bf-4.el8_4.3, edk2-aarch64 20200602gitca407c7246bf-4.el8_4.3
    fixed: vendor fix RHSA-2023:4252
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) edk2 20220126gitbb1bba3d77-2.el8_6.1, edk2-ovmf 20220126gitbb1bba3d77-2.el8_6.1, edk2-aarch64 20220126gitbb1bba3d77-2.el8_6.1
    fixed: vendor fix RHSA-2023:4128
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) openssl-perl 3.0.1-46.el9_0, edk2 20220126gitbb1bba3d77-3.el9_0.2, edk2-ovmf 20220126gitbb1bba3d77-3.el9_0.2, edk2-aarch64 20220126gitbb1bba3d77-3.el9_0.2
    fixed: vendor fix RHSA-2023:2022
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) compat-openssl11 1.1.1k-5.el9_4.1
    fixed: vendor fix RHSA-2025:7733
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) edk2 20190829git37eef91017ad-9.el8_2.2, edk2-ovmf 20190829git37eef91017ad-9.el8_2.2
    fixed: vendor fix RHSA-2023:4124
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) edk2 20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf 20200602gitca407c7246bf-4.el8_4.3
    fixed: vendor fix RHSA-2023:4252
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-9.el8_7, openssl-libs 1.1.1k-9.el8_7, openssl-perl 1.1.1k-9.el8_7
    fixed: vendor fix RHSA-2023:1405
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.0.1-47.el9_1, openssl-libs 3.0.1-47.el9_1
    fixed: vendor fix RHSA-2023:0946
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) openssl 1.1.1c-21.el8_2, openssl-libs 1.1.1c-21.el8_2, openssl-perl 1.1.1c-21.el8_2
    fixed: vendor fix RHSA-2023:1439
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) openssl 1.1.1c-6.el8_1, openssl-libs 1.1.1c-6.el8_1, openssl-perl 1.1.1c-6.el8_1
    fixed: vendor fix RHSA-2023:1437
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) openssl 1.1.1c-21.el8_2, openssl-libs 1.1.1c-21.el8_2, openssl-perl 1.1.1c-21.el8_2
    fixed: vendor fix RHSA-2023:1439
  • Red Hat Enterprise Linux BaseOS EUS (v.8.4) openssl 1.1.1g-18.el8_4, openssl-libs 1.1.1g-18.el8_4, openssl-perl 1.1.1g-18.el8_4
    fixed: vendor fix RHSA-2023:1440
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssl 1.1.1k-8.el8_6, openssl-libs 1.1.1k-8.el8_6, openssl-perl 1.1.1k-8.el8_6
    fixed: vendor fix RHSA-2023:1441
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssl 3.0.1-46.el9_0, openssl-libs 3.0.1-46.el9_0
    fixed: vendor fix RHSA-2023:1199
  • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) openssl 1.1.1c-21.el8_2, openssl-libs 1.1.1c-21.el8_2, openssl-perl 1.1.1c-21.el8_2
    fixed: vendor fix RHSA-2023:1439
  • Red Hat Enterprise Linux Client (v. 7) openssl 1.0.2k-26.el7_9, openssl-libs 1.0.2k-26.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) openssl-perl 1.0.2k-26.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-perl 1.0.2k-26.el7_9
    fixed: vendor fix RHSA-2023:1335
  • Red Hat Enterprise Linux CRB (v. 9) edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-tools 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:2165
  • Red Hat Enterprise Linux Server (v. 6 ELS) openssl 1.0.1e-61.el6_10
    fixed: vendor fix RHSA-2023:1438
  • Red Hat Enterprise Linux Server (v. 7) openssl 1.0.2k-26.el7_9, openssl-libs 1.0.2k-26.el7_9
    fixed: vendor fix RHSA-2023:1335
  • Red Hat Enterprise Linux Server AUS (v. 7.7) openssl 1.0.2k-21.el7_7.1, openssl-libs 1.0.2k-21.el7_7.1
    fixed: vendor fix RHSA-2024:5136
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) openssl-perl 1.0.1e-61.el6_10
    fixed: vendor fix RHSA-2023:1438
  • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.2k-26.el7_9
    fixed: vendor fix RHSA-2023:1335
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) openssl-perl 1.0.2k-21.el7_7.1
    fixed: vendor fix RHSA-2024:5136
  • Red Hat Enterprise Linux Workstation (v. 7) openssl 1.0.2k-26.el7_9, openssl-libs 1.0.2k-26.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.2k-26.el7_9
    fixed: vendor fix RHSA-2023:1335
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-openssl 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-openssl 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el8jbcs
    fixed: vendor fix RHSA-2023:3354
  • Red Hat JBoss Web Server 5
    fixed: vendor fix RHSA-2023:3421
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-14.redhat_14.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native 1.2.31-14.redhat_14.el8jws
    fixed: vendor fix RHSA-2023:3420

3 more fixed, 5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 7.4

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-226-21 updated cvss 7.4

Siemens BFCClient

  • Siemens BFCClient < 2.17
    affected: fixed in V2.17, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-102-04 updated cvss 7.4

Siemens RUGGEDCOM APE1808

  • Siemens RUGGEDCOM APE1808
    affected: vendor fix, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-194-04 updated cvss 7.4

Siemens SIMATIC MV500 Devices

  • Siemens SIMATIC MV540 H (6GF3540-0GE10) <V3.3.4 Siemens SIMATIC MV540 S (6GF3540-0CD10) <V3.3.4 Siemens SIMATIC MV550 H (6GF3550-0GE10) <V3.3.4 Siemens SIMATIC MV550 S (6GF3550-0CD10) <V3.3.4 Siemens SIMATIC MV560 U (6GF3560-0LE10) <V3.3.4 Siemens SIMATIC MV560 X (6GF3560-0HE10) <V3.3.4
    affected: fixed in V3.3.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-222-07 updated cvss 7.4

Siemens SIMATIC

  • Siemens SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) <V2.9.7, >=V3.0.1, <V3.0.3 Siemens SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) <V2.9.7, >=V3.0.1, <V3.0.3
    affected: fixed in V2.9.7, mitigation
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) <V21.9.7, >=V30.0.0, <V30.1.0
    affected: fixed in V21.9.7, mitigation
  • Siemens SIMATIC IPC DiagBase Siemens SIMATIC IPC DiagMonitor
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants) <V4.7
    affected: fixed in V4.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)
    affected: mitigation, no fix planned
show 25 more
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DK03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DM03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com

112 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-044-09 updated cvss 7.4

Siemens SCALANCE W700 IEEE 802.11ax

  • Siemens SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) <V3.0.0 Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) <V3.0.0 Siemens SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) <V3.0.0 Siemens SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) <V3.0.0 Siemens SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) <V3.0.0
    +13 more products
    Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) <V3.0.0 Siemens SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) <V3.0.0 Siemens SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) <V3.0.0 Siemens SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) <V3.0.0 Siemens SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) <V3.0.0 Siemens SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) <V3.0.0
    affected: fixed in V3.0.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-105-08 updated cvss 6.4

ABB M2M Gateway

  • ABB M2M Gateway >=4.1.2, <=5.0.3, >=5.0.1, <=5.0.3
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-065-01 updated cvss 7.4

Hitachi Energy PCU400

  • Hitachi Energy PCU400 <=6.5_K, <=9.4.1
    affected: fixed in 6.6.0
  • Hitachi Energy PCULogger <=1.1.0
    affected: no fix planned
  • Hitachi Energy PCU400 6.6.0, 9.4.2 Hitachi Energy PCULogger 1.2.0
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-205-02 updated cvss 7.4

Hitachi Energy AFS/AFR Series Products

  • Hitachi Energy AFR677 <=9.1.08 Hitachi Energy AFS650 <=9.1.08 Hitachi Energy AFS660-C <=7.1.05 Hitachi Energy AFS665-B <=7.1.05 Hitachi Energy AFS670 <=9.1.08 Hitachi Energy AFS670-V2 <=7.1.05
    +2 more products
    Hitachi Energy AFS675 <=9.1.08 Hitachi Energy AFS677 <=9.1.08
    affected: vendor fix, mitigation “Hitachi Energy has released the following mitigations/fixes:” publisher.hitachienergy.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-24-165-06 updated cvss 7.4

Siemens TIM 1531 IRC

  • Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) <V2.4.8 Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0) <V2.4.8
    affected: fixed in V2.4.8 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-10 updated cvss 7.4

Siemens SIMATIC and SIPLUS

  • Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) <V2.3 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) <V2.3 Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) <V2.3
    affected: fixed in V2.3 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-11 updated cvss 7.4

Siemens SCALANCE XM-400, XR-500

  • Siemens SCALANCE XM408-4C (6GK5408-4GP00-2AM2) <V6.6.1 Siemens SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (6GK5408-8GS00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (6GK5416-4GS00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) <V6.6.1
    +20 more products
    Siemens SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (6GK5528-0AA00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (6GK5552-0AA00-2AR2) <V6.6.1
    affected: fixed in V6.6.1 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-075-04 updated cvss 7.4

Siemens SCALANCE W1750D Devices

  • Siemens SCALANCE W1750D (JP) (6GK5750-2HX01-1AD0) <V8.10.0.9 Siemens SCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0) <V8.10.0.9 Siemens SCALANCE W1750D (USA) (6GK5750-2HX01-1AB0) <V8.10.0.9
    affected: fixed in V8.10.0.9, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-166-11 updated cvss 7.4

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-004-02 updated cvss 7.4

Mitsubishi Electric Factory Automation Products

  • Mitsubishi Electric GT SoftGOT2000 >=1.275M, <1.290C Mitsubishi Electric OPC UA Data Collector <=1.04E
    affected: mitigation “Mitsbuishi Electric recommends that users update their products to the following versions:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-143-02 updated cvss 7.4

Hitachi Energy's RTU500 Series Product (UPDATE B)

  • Hitachi Energy RTU500 series CMU Firmware >=12.0.1, <=12.0.15, >=12.2.1, <=12.2.12, >=12.4.1, <=12.4.12, >=12.6.1, <=12.6.9
    affected: vendor fix, mitigation “Recommended security practices and firewall configurations can help protect a process control network from attacks originating from outside the network including.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-255-01 updated cvss 7.4

Hitachi Energy Lumada APM Edge

  • Hitachi Energy Lumada APM Edge <= 4.0, 6.3
    affected: vendor fix, mitigation “For more information, see Hitachi Energy advisory 8DBD000169.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

69.29% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
OSV 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi cryptography
>=0.8.1, <39.0.1
39.0.1
crates.io openssl-src
<111.25.0
>=300.0.0, <300.0.12
>=0.0.0-0, <111.25.0
111.25.0
300.0.12
julia OpenSSL_jll
<1.1.20+0
1.1.20+0
julia Openresty_jll
<1.27.1+0
1.27.1+0

Affected products

  • OpenSSL OpenSSL
  • Siemens BFCClient
  • Siemens RUGGEDCOM APE1808
  • Siemens SCALANCE W1750D (JP)
  • Siemens SCALANCE W1750D (ROW)
  • Siemens SCALANCE W1750D (USA)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.