Skip to content
Fencer Vulns
high 7.5

CVE-2022-4450 in the critical feed json

Double free after calling PEM_read_bio_ex

published 2023-02-07 3 y ago modified 2026-10-14 25 d ago also EUVD-2023-0796 , GHSA-v5w6-wcm8-jm4q , JLSEC-2026-232 , RUSTSEC-2023-0010

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
28.6%
EPSS 28.6% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0.

The OpenSSL asn1parse command line application is also impacted by this issue.

Patch / fix

  • crates.io openssl-src 111.25.0, 300.0.12
  • julia OpenSSL_jll 1.1.20+0
  • julia Openresty_jll 1.27.1+0
  • OpenSSL OpenSSL 1.1.1t, 3.0.8
  • Siemens SCALANCE W1750D (JP) V8.10.0.9
  • Siemens SCALANCE W1750D (ROW) V8.10.0.9
  • Siemens SCALANCE W1750D (USA) V8.10.0.9
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • openssl Debian 14, Debian 13, Debian 12 3.0.8-1

debian advisories DEBIAN-CVE-2022-4450

  • edk2 Ubuntu 22.04 LTS 2022.02-3ubuntu0.22.04.4
  • nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.3
  • openssl Ubuntu 18.04 LTS 1.1.1-1ubuntu2.1~18.04.21
  • openssl Ubuntu 20.04 LTS 1.1.1f-1ubuntu2.17
  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.8
  • openssl Ubuntu Pro FIPS-updates 18.04 LTS 1.1.1-1ubuntu2.fips.2.1~18.04.21
  • openssl Ubuntu Pro FIPS-updates 20.04 LTS 1.1.1f-1ubuntu2.fips.17

ubuntu advisories UBUNTU-CVE-2022-4450

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • edk2 RHEL 8 20220126gitbb1bba3d77-4.el8
  • edk2-ovmf RHEL 8 20220126gitbb1bba3d77-4.el8
  • edk2-aarch64 RHEL 8 20220126gitbb1bba3d77-4.el8
  • openssl RHEL 9 1:3.0.1-47.el9_1
  • openssl-libs RHEL 9 1:3.0.1-47.el9_1
  • openssl-perl RHEL 9 1:3.0.1-47.el9_1
  • edk2 RHEL 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-ovmf RHEL 9 20221207gitfff6d81270b5-9.el9_2

red hat advisories RHSA-2023:2932RHSA-2023:1199RHSA-2023:0946RHSA-2023:2165RHSA-2023:3354RHSA-2023:3420

  • openssl-3 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.0.1-150400.4.17.1
  • openssl-1_1 SLE Module for Basesystem 15 SP4, SLE Micro 5.3, openSUSE Leap Micro 5.3 +1 more 1.1.1l-150400.7.22.1
  • openssl-1_1 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +13 more 1.1.1d-150200.11.57.1
  • openssl-1_1 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.1.1d-2.75.1

suse advisories SUSE-SU-2023:0312-1SUSE-SU-2023:0311-1SUSE-SU-2023:0310-1SUSE-SU-2023:0309-1

  • openssl-1_1 openSUSE Tumbleweed 1.1.1t-1.1
  • openssl-3 openSUSE Tumbleweed 3.0.8-1.1

opensuse advisories openSUSE-SU-2024:12688-1openSUSE-SU-2024:12716-1

  • edk2-ovmf AlmaLinux 8 20220126gitbb1bba3d77-4.el8
  • edk2-aarch64 AlmaLinux 8 20220126gitbb1bba3d77-4.el8
  • edk2-ovmf AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-tools AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-aarch64 AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • openssl AlmaLinux 8 1:1.1.1k-9.el8_7
  • openssl-libs AlmaLinux 8 1:1.1.1k-9.el8_7
  • openssl-perl AlmaLinux 8 1:1.1.1k-9.el8_7

almalinux advisories ALSA-2023:2932ALSA-2023:2165ALSA-2023:1405ALSA-2023:0946

  • openssl Rocky Linux 9 1:3.0.1-47.el9_1
  • openssl Rocky Linux 8 1:1.1.1k-9.el8_7

rocky linux advisories RLSA-2023:0946RLSA-2023:1405

  • openssl Alpine 3.16, Alpine 3.15, Alpine 3.14 1.1.1t-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.0.8-r0
  • openssl3 Alpine 3.16, Alpine 3.15 3.0.8-r0
  • openssl1.1-compat Alpine 3.18, Alpine 3.17 1.1.1t-r0

alpine advisories ALPINE-CVE-2022-4450

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cloud-hypervisor CBL-Mariner 2.0 30.0-2
  • openssl CBL-Mariner 2.0 1.1.1k-21
  • hvloader CBL-Mariner 2.0 1.0.1-2
  • hvloader Azure Linux 3.0 1.0.1-4

azure linux advisories AZL-13347AZL-13351AZL-37629AZL-37892

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-4450 updated cvss 7.5

openssl: double free after calling PEM_read_bio_ex

  • Red Hat Enterprise Linux 9 compat-openssl11
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Web Server 3 openssl
    affected: no fix planned “Out of support scope”
  • Red Hat JBCS httpd 2.4.51.sp2
    fixed: vendor fix RHSA-2023:3355
  • Red Hat Enterprise Linux AppStream (v. 8) edk2 20220126gitbb1bba3d77-4.el8, edk2-ovmf 20220126gitbb1bba3d77-4.el8, edk2-aarch64 20220126gitbb1bba3d77-4.el8
    fixed: vendor fix RHSA-2023:2932
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.0.1-47.el9_1, edk2 20221207gitfff6d81270b5-9.el9_2, edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:0946
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) openssl-perl 3.0.1-46.el9_0
    fixed: vendor fix RHSA-2023:1199
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-9.el8_7, openssl-libs 1.1.1k-9.el8_7, openssl-perl 1.1.1k-9.el8_7
    fixed: vendor fix RHSA-2023:1405
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.0.1-47.el9_1, openssl-libs 3.0.1-47.el9_1
    fixed: vendor fix RHSA-2023:0946
show 7 more
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssl 1.1.1k-9.el8_6, openssl-libs 1.1.1k-9.el8_6, openssl-perl 1.1.1k-9.el8_6
    fixed: vendor fix RHSA-2023:3408
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssl 3.0.1-46.el9_0, openssl-libs 3.0.1-46.el9_0
    fixed: vendor fix RHSA-2023:1199
  • Red Hat Enterprise Linux CRB (v. 9) edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-tools 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:2165
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-openssl 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-openssl 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el8jbcs
    fixed: vendor fix RHSA-2023:3354
  • Red Hat JBoss Web Server 5
    fixed: vendor fix RHSA-2023:3421
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-14.redhat_14.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native 1.2.31-14.redhat_14.el8jws Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native 1.2.31-14.redhat_14.el9jws
    fixed: vendor fix RHSA-2023:3420
  • Red Hat Enterprise Linux 6 openssl, openssl-perl Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF, openssl, openssl-libs, openssl-perl Red Hat Enterprise Linux 8 shim, shim-x64, shim-aa64, shim-ia32, compat-openssl10 Red Hat Enterprise Linux 9 shim, shim-x64, shim-aa64 Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl 8.0.1-1.el7jbcs, jbcs-httpd24-httpd 2.4.51-39.el7jbcs, jbcs-httpd24-libcurl 8.0.1-1.el7jbcs, jbcs-httpd24-mod_md 2.4.0-20.el7jbcs, jbcs-httpd24-mod_ssl 2.4.51-39.el7jbcs, jbcs-httpd24-apr-util 1.6.1-101.el7jbcs, +20 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl 8.0.1-1.el8jbcs, jbcs-httpd24-httpd 2.4.51-39.el8jbcs, jbcs-httpd24-libcurl 8.0.1-1.el8jbcs, jbcs-httpd24-mod_md 2.4.0-20.el8jbcs, jbcs-httpd24-mod_ssl 2.4.51-39.el8jbcs, jbcs-httpd24-apr-util 1.6.1-101.el8jbcs, +20 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 5.9

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-194-04 updated cvss 5.9

Siemens SIMATIC MV500 Devices

  • Siemens SIMATIC MV540 H (6GF3540-0GE10) <V3.3.4 Siemens SIMATIC MV540 S (6GF3540-0CD10) <V3.3.4 Siemens SIMATIC MV550 H (6GF3550-0GE10) <V3.3.4 Siemens SIMATIC MV550 S (6GF3550-0CD10) <V3.3.4 Siemens SIMATIC MV560 U (6GF3560-0LE10) <V3.3.4 Siemens SIMATIC MV560 X (6GF3560-0HE10) <V3.3.4
    affected: fixed in V3.3.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-044-09 updated cvss 5.9

Siemens SCALANCE W700 IEEE 802.11ax

  • Siemens SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) <V3.0.0 Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) <V3.0.0 Siemens SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) <V3.0.0 Siemens SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) <V3.0.0 Siemens SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) <V3.0.0
    +13 more products
    Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) <V3.0.0 Siemens SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) <V3.0.0 Siemens SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) <V3.0.0 Siemens SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) <V3.0.0 Siemens SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) <V3.0.0 Siemens SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) <V3.0.0
    affected: fixed in V3.0.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-065-01 updated cvss 7.5

Hitachi Energy PCU400

  • Hitachi Energy PCU400 <=6.5_K, <=9.4.1
    affected: fixed in 6.6.0
  • Hitachi Energy PCULogger <=1.1.0
    affected: no fix planned
  • Hitachi Energy PCU400 6.6.0, 9.4.2 Hitachi Energy PCULogger 1.2.0
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-205-02 updated cvss 7.5

Hitachi Energy AFS/AFR Series Products

  • Hitachi Energy AFR677 <=9.1.08 Hitachi Energy AFS650 <=9.1.08 Hitachi Energy AFS660-C <=7.1.05 Hitachi Energy AFS665-B <=7.1.05 Hitachi Energy AFS670 <=9.1.08 Hitachi Energy AFS670-V2 <=7.1.05
    +2 more products
    Hitachi Energy AFS675 <=9.1.08 Hitachi Energy AFS677 <=9.1.08
    affected: vendor fix, mitigation “Hitachi Energy has released the following mitigations/fixes:” publisher.hitachienergy.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-24-165-06 updated cvss 5.9

Siemens TIM 1531 IRC

  • Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) <V2.4.8 Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0) <V2.4.8
    affected: fixed in V2.4.8 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-10 updated cvss 5.9

Siemens SIMATIC and SIPLUS

  • Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) <V2.3 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) <V2.3 Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) <V2.3
    affected: fixed in V2.3 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-11 updated cvss 5.9

Siemens SCALANCE XM-400, XR-500

  • Siemens SCALANCE XM408-4C (6GK5408-4GP00-2AM2) <V6.6.1 Siemens SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (6GK5408-8GS00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (6GK5416-4GS00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) <V6.6.1
    +20 more products
    Siemens SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (6GK5528-0AA00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (6GK5552-0AA00-2AR2) <V6.6.1
    affected: fixed in V6.6.1 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-278-03 updated cvss 6.5

Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch (Update A)

  • Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch NZ2MHG-TSNT4 <=firmware_05
    affected: mitigation “Mitsubishi Electric recommends the following:” mitsubishielectric.com
  • Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch NZ2MHG-TSNT8F2 <=firmware_05
    affected: vendor fix, mitigation “Mitsubishi Electric recommends the following:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-075-04 updated cvss 5.9

Siemens SCALANCE W1750D Devices

  • Siemens SCALANCE W1750D (JP) (6GK5750-2HX01-1AD0) <V8.10.0.9 Siemens SCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0) <V8.10.0.9 Siemens SCALANCE W1750D (USA) (6GK5750-2HX01-1AB0) <V8.10.0.9
    affected: fixed in V8.10.0.9, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-166-11 updated cvss 5.9

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-320-08 updated cvss 5.9

Siemens SCALANCE Family Products

  • Siemens SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2) <V4.5 Siemens SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2) <V4.5 Siemens SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2) <V4.5 Siemens SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2) <V4.5 Siemens SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2) <V4.5 Siemens SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2) <V4.5
    +34 more products
    Siemens SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2) <V4.5 Siemens SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2) <V4.5 Siemens SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2) <V4.5 Siemens SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2) <V4.5 Siemens SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2) <V4.5 Siemens SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2) <V4.5 Siemens SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2) <V4.5 Siemens SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2) <V4.5 Siemens SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2) <V4.5 Siemens SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2) <V4.5 Siemens SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2) <V4.5 Siemens SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2) <V4.5 Siemens SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2) <V4.5 Siemens SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2) <V4.5 Siemens SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2) <V4.5 Siemens SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2) <V4.5 Siemens SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2) <V4.5 Siemens SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2) <V4.5 Siemens SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2) <V4.5 Siemens SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2) <V4.5 Siemens SCALANCE XC208 (6GK5208-0BA00-2AC2) <V4.5 Siemens SCALANCE XC208EEC (6GK5208-0BA00-2FC2) <V4.5 Siemens SCALANCE XC208G (6GK5208-0GA00-2AC2) <V4.5 Siemens SCALANCE XC208G (EIP def.) (6GK5208-0GA00-2TC2) <V4.5 Siemens SCALANCE XC208G EEC (6GK5208-0GA00-2FC2) <V4.5 Siemens SCALANCE XC208G PoE (6GK5208-0RA00-2AC2) <V4.5 Siemens SCALANCE XC208G PoE (54 V DC) (6GK5208-0RA00-5AC2) <V4.5 Siemens SCALANCE XC216 (6GK5216-0BA00-2AC2) <V4.5 Siemens SCALANCE XC216-3G PoE (6GK5216-3RS00-2AC2) <V4.5 Siemens SCALANCE XC216-3G PoE (54 V DC) (6GK5216-3RS00-5AC2) <V4.5 Siemens SCALANCE XC216-4C (6GK5216-4BS00-2AC2) <V4.5 Siemens SCALANCE XC216-4C G (6GK5216-4GS00-2AC2) <V4.5 Siemens SCALANCE XC216-4C G (EIP Def.) (6GK5216-4GS00-2TC2) <V4.5 Siemens SCALANCE XC216-4C G EEC (6GK5216-4GS00-2FC2) <V4.5
    affected: fixed in V4.5 support.industry.siemens.com

31 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-004-02 updated cvss 7.5

Mitsubishi Electric Factory Automation Products

  • Mitsubishi Electric FX5-OPC <=1.006_
    affected: vendor fix, mitigation “Mitsbuishi Electric recommends that users update their products to the following versions:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-255-01 updated cvss 7.5

Hitachi Energy Lumada APM Edge

  • Hitachi Energy Lumada APM Edge <= 4.0, 6.3
    affected: vendor fix, mitigation “For more information, see Hitachi Energy advisory 8DBD000169.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-229-01 updated cvss 5.9

ICONICS and Mitsubishi Electric Products

  • ICONICS, Mitsubishi Electric ICONICS Suite including GENESIS64, Hyper Historian, AnalytiX, and MobileHMI 10.97.2
    affected: mitigation “Version 10.97.2 Critical Fixes Rollup 2 and later is not vulnerable to these exploits. ICONICS recommends that users of its products take the following mitigation steps:” partners.iconics.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

28.59% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io openssl-src
<111.25.0
>=300.0.0, <300.0.12
>=0.0.0-0, <111.25.0
111.25.0
300.0.12
julia OpenSSL_jll
<1.1.20+0
1.1.20+0
julia Openresty_jll
>=1.19.9+0, <1.27.1+0
1.27.1+0

Affected products

  • OpenSSL OpenSSL
  • Siemens SCALANCE W1750D (JP)
  • Siemens SCALANCE W1750D (ROW)
  • Siemens SCALANCE W1750D (USA)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.