Skip to content
Fencer Vulns
medium 5.9

CVE-2022-4304 json

Timing Oracle in RSA Decryption

published 2023-02-07 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-0751 , GHSA-p52g-cm5j-mjv4 , JLSEC-2026-231 , RUSTSEC-2023-0007

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
23.5%
EPSS 23.5% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

Patch / fix

  • crates.io openssl-src 111.25.0, 300.0.12
  • julia OpenSSL_jll 1.1.20+0
  • julia Openresty_jll 1.27.1+0
  • OpenSSL OpenSSL 1.0.2zg, 1.1.1t, 3.0.8
  • Siemens SCALANCE W1750D (JP) V8.10.0.9
  • Siemens SCALANCE W1750D (ROW) V8.10.0.9
  • Siemens SCALANCE W1750D (USA) V8.10.0.9
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • openssl Debian 14, Debian 13, Debian 12 3.0.8-1

debian advisories DEBIAN-CVE-2022-4304

  • edk2 Ubuntu 22.04 LTS 2022.02-3ubuntu0.22.04.4
  • nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.3
  • openssl Ubuntu 18.04 LTS 1.1.1-1ubuntu2.1~18.04.21
  • openssl Ubuntu 20.04 LTS 1.1.1f-1ubuntu2.17
  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.8
  • openssl Ubuntu Pro FIPS-updates 18.04 LTS 1.1.1-1ubuntu2.fips.2.1~18.04.21
  • openssl Ubuntu Pro FIPS-updates 20.04 LTS 1.1.1f-1ubuntu2.fips.17

ubuntu advisories UBUNTU-CVE-2022-4304

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • edk2 RHEL 8 20220126gitbb1bba3d77-4.el8
  • edk2-ovmf RHEL 8 20220126gitbb1bba3d77-4.el8
  • edk2-aarch64 RHEL 8 20220126gitbb1bba3d77-4.el8
  • openssl RHEL 9 1:3.0.1-47.el9_1
  • openssl-libs RHEL 9 1:3.0.1-47.el9_1
  • openssl-perl RHEL 9 1:3.0.1-47.el9_1
  • edk2 RHEL 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-ovmf RHEL 9 20221207gitfff6d81270b5-9.el9_2

red hat advisories RHSA-2023:2932RHSA-2023:1199RHSA-2023:0946RHSA-2023:2165RHSA-2023:4128RHSA-2023:3354

  • openssl-1_1 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +11 more 1.1.1d-150200.11.72.1
  • compat-openssl098 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLE Module for Legacy 12 0.9.8j-106.58.1
  • openssl-1_1 SLE Module for Basesystem 15 SP4, SLE Micro 5.4, SLE Micro 5.3 +2 more 1.1.1l-150400.7.42.1
  • openssl SLES 12 SP2-BCL 1.0.2j-60.98.1
  • openssl-1_0_0 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +11 more 1.0.2p-150000.3.79.1
  • openssl-1_0_0 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +5 more 1.0.2p-3.78.1
  • openssl-1_1 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +5 more 1.1.1d-2.89.1
  • openssl-1_1 SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 1.1.1l-150500.17.6.1

suse advisories SUSE-SU-2023:3179-1SUSE-SU-2023:3096-1SUSE-SU-2023:2648-1SUSE-SU-2023:2634-1SUSE-SU-2023:2633-1SUSE-SU-2023:2624-1

  • openssl-1_0_0 openSUSE Tumbleweed 1.0.2u-12.1
  • openssl-1_1 openSUSE Tumbleweed 1.1.1t-1.1
  • openssl-3 openSUSE Tumbleweed 3.0.8-1.1

opensuse advisories openSUSE-SU-2024:12687-1openSUSE-SU-2024:12688-1openSUSE-SU-2024:12716-1

  • edk2-ovmf AlmaLinux 8 20220126gitbb1bba3d77-4.el8
  • edk2-aarch64 AlmaLinux 8 20220126gitbb1bba3d77-4.el8
  • edk2-ovmf AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-tools AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-aarch64 AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • openssl AlmaLinux 8 1:1.1.1k-9.el8_7
  • openssl-libs AlmaLinux 8 1:1.1.1k-9.el8_7
  • openssl-perl AlmaLinux 8 1:1.1.1k-9.el8_7

almalinux advisories ALSA-2023:2932ALSA-2023:2165ALSA-2023:1405ALSA-2023:0946

  • openssl Rocky Linux 9 1:3.0.1-47.el9_1
  • openssl Rocky Linux 8 1:1.1.1k-9.el8_7

rocky linux advisories RLSA-2023:0946RLSA-2023:1405

  • openssl Alpine 3.16, Alpine 3.15, Alpine 3.14 1.1.1t-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.0.8-r0
  • openssl3 Alpine 3.16, Alpine 3.15 3.0.8-r0
  • openssl1.1-compat Alpine 3.18, Alpine 3.17 1.1.1t-r0

alpine advisories ALPINE-CVE-2022-4304

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cloud-hypervisor CBL-Mariner 2.0 30.0-2
  • openssl CBL-Mariner 2.0 1.1.1k-21
  • edk2 CBL-Mariner 2.0 20230301gitf80f052277c8-42
  • edk2 Azure Linux 3.0 20240223gitedc6681206c1-1
  • hvloader CBL-Mariner 2.0 1.0.1-2
  • hvloader Azure Linux 3.0 1.0.1-4

azure linux advisories AZL-13302AZL-13310AZL-31140AZL-34668AZL-37662AZL-37955

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-4304 updated cvss 5.9

openssl: timing attack in RSA Decryption implementation

  • Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF, openssl, openssl-libs, openssl-perl
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 compat-openssl10 Red Hat Enterprise Linux 9 shim, shim-x64, shim-aa64, compat-openssl11
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Web Server 3 openssl
    affected: no fix planned “Out of support scope”
  • Red Hat JBCS httpd 2.4.51.sp2
    fixed: vendor fix RHSA-2023:3355
  • Red Hat Enterprise Linux AppStream (v. 8) edk2 20220126gitbb1bba3d77-4.el8, edk2-ovmf 20220126gitbb1bba3d77-4.el8, edk2-aarch64 20220126gitbb1bba3d77-4.el8
    fixed: vendor fix RHSA-2023:2932
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.0.1-47.el9_1, edk2 20221207gitfff6d81270b5-9.el9_2, edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:0946
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) edk2 20220126gitbb1bba3d77-2.el8_6.1, edk2-ovmf 20220126gitbb1bba3d77-2.el8_6.1, edk2-aarch64 20220126gitbb1bba3d77-2.el8_6.1
    fixed: vendor fix RHSA-2023:4128
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) openssl-perl 3.0.1-46.el9_0
    fixed: vendor fix RHSA-2023:1199
show 9 more
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-9.el8_7, openssl-libs 1.1.1k-9.el8_7, openssl-perl 1.1.1k-9.el8_7
    fixed: vendor fix RHSA-2023:1405
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.0.1-47.el9_1, openssl-libs 3.0.1-47.el9_1
    fixed: vendor fix RHSA-2023:0946
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssl 1.1.1k-9.el8_6, openssl-libs 1.1.1k-9.el8_6, openssl-perl 1.1.1k-9.el8_6
    fixed: vendor fix RHSA-2023:3408
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssl 3.0.1-46.el9_0, openssl-libs 3.0.1-46.el9_0
    fixed: vendor fix RHSA-2023:1199
  • Red Hat Enterprise Linux CRB (v. 9) edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-tools 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:2165
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-openssl 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-openssl 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el8jbcs
    fixed: vendor fix RHSA-2023:3354
  • Red Hat JBoss Web Server 5
    fixed: vendor fix RHSA-2023:3421
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-14.redhat_14.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native 1.2.31-14.redhat_14.el8jws Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native 1.2.31-14.redhat_14.el9jws
    fixed: vendor fix RHSA-2023:3420
  • Red Hat Enterprise Linux 6 openssl, openssl-perl Red Hat Enterprise Linux 8 shim, shim-x64, shim-aa64, shim-ia32 Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl 8.0.1-1.el7jbcs, jbcs-httpd24-httpd 2.4.51-39.el7jbcs, jbcs-httpd24-libcurl 8.0.1-1.el7jbcs, jbcs-httpd24-mod_md 2.4.0-20.el7jbcs, jbcs-httpd24-mod_ssl 2.4.51-39.el7jbcs, jbcs-httpd24-apr-util 1.6.1-101.el7jbcs, +20 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl 8.0.1-1.el8jbcs, jbcs-httpd24-httpd 2.4.51-39.el8jbcs, jbcs-httpd24-libcurl 8.0.1-1.el8jbcs, jbcs-httpd24-mod_md 2.4.0-20.el8jbcs, jbcs-httpd24-mod_ssl 2.4.51-39.el8jbcs, jbcs-httpd24-apr-util 1.6.1-101.el8jbcs, +20 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-141-01 updated cvss 5.9

Hitachi Energy GMS600

  • Hitachi Energy GMS600 >= 1.3.0, <= 1.3.1
    affected: fixed in 1.3.2

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-160-02 updated cvss 5.9

Hitachi Energy Relion 670, 650, SAM600-IO Series (Update A)

  • Hitachi Energy Relion 670 series vers:Relion_670/>=2.2.2, <=2.2.2.5, vers:Relion_670/>=2.2.3, <=2.2.3.6
    affected: fixed in 2.2.2.6
  • Hitachi Energy Relion 670/650 series vers:Relion_670/650/>=2.2.4, <=2.2.4.3
    affected: fixed in 2.2.4.4, mitigation
  • Hitachi Energy Relion 670/650/SAM600-IO series vers:Relion_670/650/SAM600-IO/>=2.2.1, <=2.2.1.8, vers:Relion_670/650/SAM600-IO/>=2.2.5, <=2.2.5.5
    affected: fixed in 2.2.1.9

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-348-10 updated cvss 5.9

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-194-04 updated cvss 5.9

Siemens SIMATIC MV500 Devices

  • Siemens SIMATIC MV540 H (6GF3540-0GE10) <V3.3.4 Siemens SIMATIC MV540 S (6GF3540-0CD10) <V3.3.4 Siemens SIMATIC MV550 H (6GF3550-0GE10) <V3.3.4 Siemens SIMATIC MV550 S (6GF3550-0CD10) <V3.3.4 Siemens SIMATIC MV560 U (6GF3560-0LE10) <V3.3.4 Siemens SIMATIC MV560 X (6GF3560-0HE10) <V3.3.4
    affected: fixed in V3.3.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-222-09 updated cvss 5.9

Siemens SIMATIC

  • Siemens SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00) <V2.2 Siemens SIMATIC Cloud Connect 7 CC716 (6GK1411-5AC00) <V2.2
    affected: fixed in V2.2, mitigation support.industry.siemens.com
  • Siemens SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) >=V3.0.1, <V3.0.3, <V2.9.7 Siemens SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) >=V3.0.1, <V3.0.3, <V2.9.7
    affected: fixed in V2.9.7, mitigation
  • Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) <V21.9.7, >=V30.0.0, <V30.1.0
    affected: fixed in V21.9.7, mitigation
show 26 more
  • Siemens SIMATIC Logon V1.6 Siemens SIMATIC PDM V9.1
    affected: mitigation, no fix planned
  • Siemens SIMATIC PDM V9.2 <V9.2_SP2_Upd1
    affected: fixed in V9.2, mitigation support.industry.siemens.com
  • Siemens SIMATIC Process Historian 2019 OPC UA Server Siemens SIMATIC Process Historian 2020 OPC UA Server
    affected: mitigation, no fix planned
  • Siemens SIMATIC Process Historian 2022 OPC UA Server <V2022_SP1
    affected: fixed in V2022, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0) <V3.3.19
    affected: fixed in V3.3.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0) <V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants) <V4.7
    affected: fixed in V4.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DK03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)
    affected: mitigation, no fix planned

140 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-044-09 updated cvss 5.9

Siemens SCALANCE W700 IEEE 802.11ax

  • Siemens SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) <V3.0.0 Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) <V3.0.0 Siemens SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) <V3.0.0 Siemens SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) <V3.0.0 Siemens SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) <V3.0.0
    +13 more products
    Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) <V3.0.0 Siemens SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) <V3.0.0 Siemens SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) <V3.0.0 Siemens SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) <V3.0.0 Siemens SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) <V3.0.0 Siemens SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) <V3.0.0
    affected: fixed in V3.0.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-065-01 updated cvss 5.9

Hitachi Energy PCU400

  • Hitachi Energy PCU400 <=6.5_K, <=9.4.1
    affected: fixed in 6.6.0
  • Hitachi Energy PCULogger <=1.1.0
    affected: no fix planned
  • Hitachi Energy PCU400 6.6.0, 9.4.2 Hitachi Energy PCULogger 1.2.0
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-205-02 updated cvss 5.9

Hitachi Energy AFS/AFR Series Products

  • Hitachi Energy AFR677 <=9.1.08 Hitachi Energy AFS650 <=9.1.08 Hitachi Energy AFS660-C <=7.1.05 Hitachi Energy AFS665-B <=7.1.05 Hitachi Energy AFS670 <=9.1.08 Hitachi Energy AFS670-V2 <=7.1.05
    +2 more products
    Hitachi Energy AFS675 <=9.1.08 Hitachi Energy AFS677 <=9.1.08
    affected: vendor fix, mitigation “Hitachi Energy has released the following mitigations/fixes:” publisher.hitachienergy.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-24-165-06 updated cvss 5.9

Siemens TIM 1531 IRC

  • Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) <V2.4.8 Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0) <V2.4.8
    affected: fixed in V2.4.8 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-10 updated cvss 5.9

Siemens SIMATIC and SIPLUS

  • Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) <V2.3 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) <V2.3 Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) <V2.3
    affected: fixed in V2.3 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-11 updated cvss 5.9

Siemens SCALANCE XM-400, XR-500

  • Siemens SCALANCE XM408-4C (6GK5408-4GP00-2AM2) <V6.6.1 Siemens SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (6GK5408-8GS00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (6GK5416-4GS00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) <V6.6.1
    +20 more products
    Siemens SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (6GK5528-0AA00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (6GK5552-0AA00-2AR2) <V6.6.1
    affected: fixed in V6.6.1 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-278-03 updated cvss 5.9

Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch (Update A)

  • Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch NZ2MHG-TSNT4 <=firmware_05
    affected: mitigation “Mitsubishi Electric recommends the following:” mitsubishielectric.com
  • Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch NZ2MHG-TSNT8F2 <=firmware_05
    affected: vendor fix, mitigation “Mitsubishi Electric recommends the following:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-075-04 updated cvss 5.9

Siemens SCALANCE W1750D Devices

  • Siemens SCALANCE W1750D (JP) (6GK5750-2HX01-1AD0) <V8.10.0.9 Siemens SCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0) <V8.10.0.9 Siemens SCALANCE W1750D (USA) (6GK5750-2HX01-1AB0) <V8.10.0.9
    affected: fixed in V8.10.0.9, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-166-11 updated cvss 5.9

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-320-08 updated cvss 5.9

Siemens SCALANCE Family Products

  • Siemens SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2) <V4.5 Siemens SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2) <V4.5 Siemens SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2) <V4.5 Siemens SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2) <V4.5 Siemens SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2) <V4.5 Siemens SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2) <V4.5
    +34 more products
    Siemens SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2) <V4.5 Siemens SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2) <V4.5 Siemens SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2) <V4.5 Siemens SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2) <V4.5 Siemens SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2) <V4.5 Siemens SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2) <V4.5 Siemens SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2) <V4.5 Siemens SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2) <V4.5 Siemens SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2) <V4.5 Siemens SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2) <V4.5 Siemens SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2) <V4.5 Siemens SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2) <V4.5 Siemens SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2) <V4.5 Siemens SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2) <V4.5 Siemens SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2) <V4.5 Siemens SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2) <V4.5 Siemens SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2) <V4.5 Siemens SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2) <V4.5 Siemens SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2) <V4.5 Siemens SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2) <V4.5 Siemens SCALANCE XC208 (6GK5208-0BA00-2AC2) <V4.5 Siemens SCALANCE XC208EEC (6GK5208-0BA00-2FC2) <V4.5 Siemens SCALANCE XC208G (6GK5208-0GA00-2AC2) <V4.5 Siemens SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2) <V4.5 Siemens SCALANCE XC208G EEC (6GK5208-0GA00-2FC2) <V4.5 Siemens SCALANCE XC208G PoE (6GK5208-0RA00-2AC2) <V4.5 Siemens SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2) <V4.5 Siemens SCALANCE XC216 (6GK5216-0BA00-2AC2) <V4.5 Siemens SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2) <V4.5 Siemens SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2) <V4.5 Siemens SCALANCE XC216-4C (6GK5216-4BS00-2AC2) <V4.5 Siemens SCALANCE XC216-4C G (6GK5216-4GS00-2AC2) <V4.5 Siemens SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2) <V4.5 Siemens SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2) <V4.5
    affected: fixed in V4.5 support.industry.siemens.com

31 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-004-02 updated cvss 5.9

Mitsubishi Electric Factory Automation Products

  • Mitsubishi Electric FX5-OPC <=1.006_
    affected: vendor fix, mitigation “Mitsbuishi Electric recommends that users update their products to the following versions:” mitsubishielectric.com
  • Mitsubishi Electric MX OPC Server UA (Software packaged with MC Works64) >=3.05F_Packaged_with_MC_Works64_4.03D
    affected: mitigation “Mitsbuishi Electric recommends that users update their products to the following versions:” mitsubishielectric.com
  • Mitsubishi Electric OPC UA Server Unit
    affected: vendor fix, mitigation “Mitsbuishi Electric recommends that users update their products to the following versions:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-143-02 updated cvss 5.9

Hitachi Energy's RTU500 Series Product (UPDATE B)

  • Hitachi Energy RTU500 series CMU Firmware >=12.0.1, <=12.0.15, >=12.2.1, <=12.2.12, >=12.4.1, <=12.4.12, >=12.6.1, <=12.6.9
    affected: vendor fix, mitigation “Recommended security practices and firewall configurations can help protect a process control network from attacks originating from outside the network including.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-255-01 updated cvss 5.9

Hitachi Energy Lumada APM Edge

  • Hitachi Energy Lumada APM Edge <= 4.0, 6.3
    affected: vendor fix, mitigation “For more information, see Hitachi Energy advisory 8DBD000169.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

23.51% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
crates.io openssl-src
<111.25.0
>=300.0.0, <300.0.12
>=0.0.0-0, <111.25.0
111.25.0
300.0.12
julia OpenSSL_jll
<1.1.20+0
1.1.20+0
julia Openresty_jll
<1.27.1+0
1.27.1+0

Affected products

  • OpenSSL OpenSSL
  • Siemens SCALANCE W1750D (JP)
  • Siemens SCALANCE W1750D (ROW)
  • Siemens SCALANCE W1750D (USA)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.