Skip to content
Fencer Intel
high 7.4

CVE-2023-0286 in the critical feed json

X.400 address type confusion in X.509 GeneralName

published 3y ago modified last mo. also EUVD-2023-0817 , GHSA-x4qr-2fvf-3mr5 , JLSEC-2026-234 , PYSEC-2026-800 , RUSTSEC-2023-0006

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
68.4%
EPSS 68.4% chance of exploitation in 30 days, percentile 99.3%
public exploits
0
none known

Summary

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Patch / fix

  • pypi cryptography 39.0.1
  • crates.io openssl-src 111.25.0, 300.0.12
  • julia OpenSSL_jll 1.1.20+0
  • julia Openresty_jll 1.27.1+0
  • OpenSSL OpenSSL 1.0.2zg, 1.1.1t, 3.0.8
  • Siemens BFCClient V2.17
  • Siemens SCALANCE W1750D (JP) V8.10.0.9
  • Siemens SCALANCE W1750D (ROW) V8.10.0.9
  • Siemens SCALANCE W1750D (USA) V8.10.0.9
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • openssl Debian 14, Debian 13, Debian 12 3.0.8-1

debian advisories DEBIAN-CVE-2023-0286

  • edk2 Ubuntu 22.04 LTS 2022.02-3ubuntu0.22.04.4
  • nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.3
  • openssl Ubuntu 18.04 LTS 1.1.1-1ubuntu2.1~18.04.21
  • openssl Ubuntu 20.04 LTS 1.1.1f-1ubuntu2.17
  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.8
  • openssl1.0 Ubuntu 18.04 LTS 1.0.2n-1ubuntu5.11
  • openssl Ubuntu Pro 14.04 LTS 1.0.1f-1ubuntu2.27+esm6
  • openssl Ubuntu Pro 16.04 LTS 1.0.2g-1ubuntu4.20+esm6

ubuntu advisories UBUNTU-CVE-2023-0286

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • redhat-virtualization-host rhev hypervisor 4.4 4.5.3-202309130206_8.6
  • redhat-virtualization-host-image-update rhev hypervisor 4.4 4.5.3-202309130206_8.6
  • edk2 RHEL 8 20220126gitbb1bba3d77-4.el8
  • edk2-ovmf RHEL 8 20220126gitbb1bba3d77-4.el8
  • edk2-aarch64 RHEL 8 20220126gitbb1bba3d77-4.el8
  • compat-openssl11 RHEL 9 1:1.1.1k-5.el9_6.1
  • compat-openssl10 RHEL 8 1:1.0.2o-4.el8_10.1
  • openssl RHEL 9 1:3.0.1-47.el9_1

red hat advisories RHSA-2023:5209RHSA-2023:2932RHSA-2023:2022RHSA-2025:7937RHSA-2025:7895RHSA-2025:7733

  • openssl SLES 12 SP2-BCL 1.0.2j-60.86.1
  • openssl-1_1-livepatches SLE Live Patching 15 SP4, openSUSE Leap 15.4 0.1-150400.3.3.1
  • openssl-3 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.0.1-150400.4.17.1
  • openssl-1_1 SLE Module for Basesystem 15 SP4, SLE Micro 5.3, openSUSE Leap Micro 5.3 +1 more 1.1.1l-150400.7.22.1
  • openssl-1_1 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +13 more 1.1.1d-150200.11.57.1
  • openssl-1_1 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.1.1d-2.75.1
  • openssl-1_0_0 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.0.2p-3.64.1
  • openssl-1_0_0 SLE Module for Legacy 15 SP4, SLE High Performance Computing 15 SP3-ESPOS, openSUSE Leap 15.4 +9 more 1.0.2p-150000.3.65.1

suse advisories SUSE-SU-2023:0684-1SUSE-SU-2023:0482-1SUSE-SU-2023:0312-1SUSE-SU-2023:0311-1SUSE-SU-2023:0310-1SUSE-SU-2023:0309-1

  • rubygem-grpc openSUSE Tumbleweed 1.70.1-1.7
  • python315 openSUSE Tumbleweed 3.15.0~a1-1.1
  • rubygem-grpc openSUSE Tumbleweed 1.70.1-1.1
  • python314 openSUSE Tumbleweed 3.14.0~a1-1.1
  • python313 openSUSE Tumbleweed 3.13.0~b3-1.1
  • openssl-1_0_0 openSUSE Tumbleweed 1.0.2u-12.1
  • openssl-1_1 openSUSE Tumbleweed 1.1.1t-1.1
  • openssl-3 openSUSE Tumbleweed 3.0.8-1.1

opensuse advisories openSUSE-SU-2026:10348-1openSUSE-SU-2025:15713-1openSUSE-SU-2025:14821-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14109-1openSUSE-SU-2024:12687-1

  • compat-openssl10 AlmaLinux 8 1:1.0.2o-4.el8_10.1
  • compat-openssl11 AlmaLinux 9 1:1.1.1k-5.el9_6.1
  • edk2-ovmf AlmaLinux 8 20220126gitbb1bba3d77-4.el8
  • edk2-aarch64 AlmaLinux 8 20220126gitbb1bba3d77-4.el8
  • edk2-ovmf AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-tools AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • edk2-aarch64 AlmaLinux 9 20221207gitfff6d81270b5-9.el9_2
  • openssl AlmaLinux 8 1:1.1.1k-9.el8_7

almalinux advisories ALSA-2025:7895ALSA-2025:7937ALSA-2023:2932ALSA-2023:2165ALSA-2023:1405ALSA-2023:0946

  • compat-openssl11 Rocky Linux 9 1:1.1.1k-5.el9_6.1
  • compat-openssl10 Rocky Linux 8 1:1.0.2o-4.el8_10.1
  • openssl Rocky Linux 9 1:3.0.1-47.el9_1
  • openssl Rocky Linux 8 1:1.1.1k-9.el8_7

rocky linux advisories RLSA-2025:7937RLSA-2025:7895RLSA-2023:0946RLSA-2023:1405

  • openssl Alpine 3.16, Alpine 3.15, Alpine 3.14 1.1.1t-r0
  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.0.8-r0
  • openssl3 Alpine 3.16, Alpine 3.15 3.0.8-r0
  • openssl1.1-compat Alpine 3.18, Alpine 3.17 1.1.1t-r0

alpine advisories ALPINE-CVE-2023-0286

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl CBL-Mariner 2.0 1.1.1k-21
  • cloud-hypervisor CBL-Mariner 2.0 30.0-2
  • hvloader CBL-Mariner 2.0 1.0.1-2
  • hvloader Azure Linux 3.0 1.0.1-4

azure linux advisories AZL-13564AZL-13701AZL-37614AZL-37883

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2023-0286 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-0286 updated cvss 7.4

openssl: X.400 address type confusion in X.509 GeneralName

  • Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Web Server 3 openssl
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat JBCS httpd 2.4.51.sp2
    fixed: vendor fix RHSA-2023:3355
  • Red Hat Enterprise Linux AppStream (v. 8) edk2 20220126gitbb1bba3d77-4.el8, compat-openssl10 1.0.2o-4.el8_10.1, edk2-ovmf 20220126gitbb1bba3d77-4.el8, edk2-aarch64 20220126gitbb1bba3d77-4.el8
    fixed: vendor fix RHSA-2025:7895
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.0.1-47.el9_1, compat-openssl11 1.1.1k-5.el9_6.1, edk2 20221207gitfff6d81270b5-9.el9_2, edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:0946
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) edk2 20190829git37eef91017ad-9.el8_2.2, edk2-ovmf 20190829git37eef91017ad-9.el8_2.2
    fixed: vendor fix RHSA-2023:4124
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) edk2 20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf 20200602gitca407c7246bf-4.el8_4.3
    fixed: vendor fix RHSA-2023:4252
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) edk2 20190829git37eef91017ad-9.el8_2.2, edk2-ovmf 20190829git37eef91017ad-9.el8_2.2
    fixed: vendor fix RHSA-2023:4124
show 27 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) edk2 20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf 20200602gitca407c7246bf-4.el8_4.3, edk2-aarch64 20200602gitca407c7246bf-4.el8_4.3
    fixed: vendor fix RHSA-2023:4252
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) edk2 20220126gitbb1bba3d77-2.el8_6.1, edk2-ovmf 20220126gitbb1bba3d77-2.el8_6.1, edk2-aarch64 20220126gitbb1bba3d77-2.el8_6.1
    fixed: vendor fix RHSA-2023:4128
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) openssl-perl 3.0.1-46.el9_0, edk2 20220126gitbb1bba3d77-3.el9_0.2, edk2-ovmf 20220126gitbb1bba3d77-3.el9_0.2, edk2-aarch64 20220126gitbb1bba3d77-3.el9_0.2
    fixed: vendor fix RHSA-2023:2022
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) compat-openssl11 1.1.1k-5.el9_4.1
    fixed: vendor fix RHSA-2025:7733
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) edk2 20190829git37eef91017ad-9.el8_2.2, edk2-ovmf 20190829git37eef91017ad-9.el8_2.2
    fixed: vendor fix RHSA-2023:4124
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) edk2 20200602gitca407c7246bf-4.el8_4.3, edk2-ovmf 20200602gitca407c7246bf-4.el8_4.3
    fixed: vendor fix RHSA-2023:4252
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-9.el8_7, openssl-libs 1.1.1k-9.el8_7, openssl-perl 1.1.1k-9.el8_7
    fixed: vendor fix RHSA-2023:1405
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.0.1-47.el9_1, openssl-libs 3.0.1-47.el9_1
    fixed: vendor fix RHSA-2023:0946
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) openssl 1.1.1c-21.el8_2, openssl-libs 1.1.1c-21.el8_2, openssl-perl 1.1.1c-21.el8_2
    fixed: vendor fix RHSA-2023:1439
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) openssl 1.1.1c-6.el8_1, openssl-libs 1.1.1c-6.el8_1, openssl-perl 1.1.1c-6.el8_1
    fixed: vendor fix RHSA-2023:1437
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) openssl 1.1.1c-21.el8_2, openssl-libs 1.1.1c-21.el8_2, openssl-perl 1.1.1c-21.el8_2
    fixed: vendor fix RHSA-2023:1439
  • Red Hat Enterprise Linux BaseOS EUS (v.8.4) openssl 1.1.1g-18.el8_4, openssl-libs 1.1.1g-18.el8_4, openssl-perl 1.1.1g-18.el8_4
    fixed: vendor fix RHSA-2023:1440
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) openssl 1.1.1k-8.el8_6, openssl-libs 1.1.1k-8.el8_6, openssl-perl 1.1.1k-8.el8_6
    fixed: vendor fix RHSA-2023:1441
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) openssl 3.0.1-46.el9_0, openssl-libs 3.0.1-46.el9_0
    fixed: vendor fix RHSA-2023:1199
  • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) openssl 1.1.1c-21.el8_2, openssl-libs 1.1.1c-21.el8_2, openssl-perl 1.1.1c-21.el8_2
    fixed: vendor fix RHSA-2023:1439
  • Red Hat Enterprise Linux Client (v. 7) openssl 1.0.2k-26.el7_9, openssl-libs 1.0.2k-26.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) openssl-perl 1.0.2k-26.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-perl 1.0.2k-26.el7_9
    fixed: vendor fix RHSA-2023:1335
  • Red Hat Enterprise Linux CRB (v. 9) edk2-ovmf 20221207gitfff6d81270b5-9.el9_2, edk2-tools 20221207gitfff6d81270b5-9.el9_2, edk2-aarch64 20221207gitfff6d81270b5-9.el9_2
    fixed: vendor fix RHSA-2023:2165
  • Red Hat Enterprise Linux Server (v. 6 ELS) openssl 1.0.1e-61.el6_10
    fixed: vendor fix RHSA-2023:1438
  • Red Hat Enterprise Linux Server (v. 7) openssl 1.0.2k-26.el7_9, openssl-libs 1.0.2k-26.el7_9
    fixed: vendor fix RHSA-2023:1335
  • Red Hat Enterprise Linux Server AUS (v. 7.7) openssl 1.0.2k-21.el7_7.1, openssl-libs 1.0.2k-21.el7_7.1
    fixed: vendor fix RHSA-2024:5136
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) openssl-perl 1.0.1e-61.el6_10
    fixed: vendor fix RHSA-2023:1438
  • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.2k-26.el7_9
    fixed: vendor fix RHSA-2023:1335
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) openssl-perl 1.0.2k-21.el7_7.1
    fixed: vendor fix RHSA-2024:5136
  • Red Hat Enterprise Linux Workstation (v. 7) openssl 1.0.2k-26.el7_9, openssl-libs 1.0.2k-26.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.2k-26.el7_9
    fixed: vendor fix RHSA-2023:1335
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-openssl 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el7jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-openssl 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-libs 1.1.1k-14.el8jbcs, jbcs-httpd24-openssl-perl 1.1.1k-14.el8jbcs
    fixed: vendor fix RHSA-2023:3354
  • Red Hat JBoss Web Server 5
    fixed: vendor fix RHSA-2023:3421
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-14.redhat_14.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native 1.2.31-14.redhat_14.el8jws
    fixed: vendor fix RHSA-2023:3420

3 more fixed, 5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 7.4

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-226-21 updated cvss 7.4

Siemens BFCClient

  • Siemens BFCClient < 2.17
    affected: fixed in V2.17, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-102-04 updated cvss 7.4

Siemens RUGGEDCOM APE1808

  • Siemens RUGGEDCOM APE1808
    affected: vendor fix, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-194-04 updated cvss 7.4

Siemens SIMATIC MV500 Devices

  • Siemens SIMATIC MV540 H (6GF3540-0GE10) <V3.3.4 Siemens SIMATIC MV540 S (6GF3540-0CD10) <V3.3.4 Siemens SIMATIC MV550 H (6GF3550-0GE10) <V3.3.4 Siemens SIMATIC MV550 S (6GF3550-0CD10) <V3.3.4 Siemens SIMATIC MV560 U (6GF3560-0LE10) <V3.3.4 Siemens SIMATIC MV560 X (6GF3560-0HE10) <V3.3.4
    affected: fixed in V3.3.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-222-07 updated cvss 7.4

Siemens SIMATIC

  • Siemens SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0) <V2.9.7, >=V3.0.1, <V3.0.3 Siemens SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0) <V2.9.7, >=V3.0.1, <V3.0.3
    affected: fixed in V2.9.7, mitigation
  • Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) <V21.9.7, >=V30.0.0, <V30.1.0
    affected: fixed in V21.9.7, mitigation
  • Siemens SIMATIC IPC DiagBase Siemens SIMATIC IPC DiagMonitor
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants) <V4.7
    affected: fixed in V4.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)
    affected: mitigation, no fix planned
show 25 more
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DK03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DM03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0) <V2.9.7 Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0) <V3.0.3
    affected: fixed in V3.0.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0)
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0) <V2.9.7
    affected: fixed in V2.9.7, mitigation support.industry.siemens.com

112 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-044-09 updated cvss 7.4

Siemens SCALANCE W700 IEEE 802.11ax

  • Siemens SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) <V3.0.0 Siemens SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) <V3.0.0 Siemens SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) <V3.0.0 Siemens SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) <V3.0.0 Siemens SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) <V3.0.0
    +13 more products
    Siemens SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) <V3.0.0 Siemens SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) <V3.0.0 Siemens SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) <V3.0.0 Siemens SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) <V3.0.0 Siemens SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) <V3.0.0 Siemens SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) <V3.0.0 Siemens SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) <V3.0.0 Siemens SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) <V3.0.0 Siemens SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) <V3.0.0
    affected: fixed in V3.0.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-105-08 updated cvss 6.4

ABB M2M Gateway

  • ABB M2M Gateway >=4.1.2, <=5.0.3, >=5.0.1, <=5.0.3
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-065-01 updated cvss 7.4

Hitachi Energy PCU400

  • Hitachi Energy PCU400 <=6.5_K, <=9.4.1
    affected: fixed in 6.6.0
  • Hitachi Energy PCULogger <=1.1.0
    affected: no fix planned
  • Hitachi Energy PCU400 6.6.0, 9.4.2 Hitachi Energy PCULogger 1.2.0
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-205-02 updated cvss 7.4

Hitachi Energy AFS/AFR Series Products

  • Hitachi Energy AFR677 <=9.1.08 Hitachi Energy AFS650 <=9.1.08 Hitachi Energy AFS660-C <=7.1.05 Hitachi Energy AFS665-B <=7.1.05 Hitachi Energy AFS670 <=9.1.08 Hitachi Energy AFS670-V2 <=7.1.05
    +2 more products
    Hitachi Energy AFS675 <=9.1.08 Hitachi Energy AFS677 <=9.1.08
    affected: vendor fix, mitigation “Hitachi Energy has released the following mitigations/fixes:” publisher.hitachienergy.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-24-165-06 updated cvss 7.4

Siemens TIM 1531 IRC

  • Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) <V2.4.8 Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0) <V2.4.8
    affected: fixed in V2.4.8 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-10 updated cvss 7.4

Siemens SIMATIC and SIPLUS

  • Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) <V2.3 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) <V2.3 Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) <V2.3 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) <V2.3
    affected: fixed in V2.3 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-165-11 updated cvss 7.4

Siemens SCALANCE XM-400, XR-500

  • Siemens SCALANCE XM408-4C (6GK5408-4GP00-2AM2) <V6.6.1 Siemens SCALANCE XM408-4C (L3 int.) (6GK5408-4GQ00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (6GK5408-8GS00-2AM2) <V6.6.1 Siemens SCALANCE XM408-8C (L3 int.) (6GK5408-8GR00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (6GK5416-4GS00-2AM2) <V6.6.1 Siemens SCALANCE XM416-4C (L3 int.) (6GK5416-4GR00-2AM2) <V6.6.1
    +20 more products
    Siemens SCALANCE XR524-8C, 1x230V (6GK5524-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 1x230V (L3 int.) (6GK5524-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (6GK5524-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 2x230V (L3 int.) (6GK5524-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (6GK5524-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR524-8C, 24V (L3 int.) (6GK5524-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (6GK5526-8GS00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 1x230V (L3 int.) (6GK5526-8GR00-3AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (6GK5526-8GS00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 2x230V (L3 int.) (6GK5526-8GR00-4AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (6GK5526-8GS00-2AR2) <V6.6.1 Siemens SCALANCE XR526-8C, 24V (L3 int.) (6GK5526-8GR00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2, L3 int.) (6GK5528-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (2HR2) (6GK5528-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR528-6M (6GK5528-0AA00-2AR2) <V6.6.1 Siemens SCALANCE XR528-6M (L3 int.) (6GK5528-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2, L3 int.) (6GK5552-0AR00-2AR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AA00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (2HR2) (6GK5552-0AR00-2HR2) <V6.6.1 Siemens SCALANCE XR552-12M (6GK5552-0AA00-2AR2) <V6.6.1
    affected: fixed in V6.6.1 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-075-04 updated cvss 7.4

Siemens SCALANCE W1750D Devices

  • Siemens SCALANCE W1750D (JP) (6GK5750-2HX01-1AD0) <V8.10.0.9 Siemens SCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0) <V8.10.0.9 Siemens SCALANCE W1750D (USA) (6GK5750-2HX01-1AB0) <V8.10.0.9
    affected: fixed in V8.10.0.9, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-166-11 updated cvss 7.4

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-004-02 updated cvss 7.4

Mitsubishi Electric Factory Automation Products

  • Mitsubishi Electric GT SoftGOT2000 >=1.275M, <1.290C Mitsubishi Electric OPC UA Data Collector <=1.04E
    affected: mitigation “Mitsbuishi Electric recommends that users update their products to the following versions:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-143-02 updated cvss 7.4

Hitachi Energy's RTU500 Series Product (UPDATE B)

  • Hitachi Energy RTU500 series CMU Firmware >=12.0.1, <=12.0.15, >=12.2.1, <=12.2.12, >=12.4.1, <=12.4.12, >=12.6.1, <=12.6.9
    affected: vendor fix, mitigation “Recommended security practices and firewall configurations can help protect a process control network from attacks originating from outside the network including.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-23-255-01 updated cvss 7.4

Hitachi Energy Lumada APM Edge

  • Hitachi Energy Lumada APM Edge <= 4.0, 6.3
    affected: vendor fix, mitigation “For more information, see Hitachi Energy advisory 8DBD000169.” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

68.41% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
OSV 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi cryptography
>=0.8.1, <39.0.1
39.0.1
crates.io openssl-src
<111.25.0
>=300.0.0, <300.0.12
>=0.0.0-0, <111.25.0
111.25.0
300.0.12
julia OpenSSL_jll
<1.1.20+0
1.1.20+0
julia Openresty_jll
<1.27.1+0
1.27.1+0

Affected products

  • OpenSSL OpenSSL
  • Siemens BFCClient
  • Siemens RUGGEDCOM APE1808
  • Siemens SCALANCE W1750D (JP)
  • Siemens SCALANCE W1750D (ROW)
  • Siemens SCALANCE W1750D (USA)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of pyca/cryptography published their own advisory on GitHub. Reviewed sources take precedence over it.