CVSS 9.8, no authentication required, and a stack buffer overflow that fires before any crypto checks - that's the trifecta behind CVE-2025-15467, now hitting over a hundred Siemens industrial product lines.
OpenSSL published a warning: parsing crafted CMS AuthEnvelopedData messages with oversized AEAD parameters copies the IV into a fixed-size stack buffer. No bounds check. No tag verification needed. An attacker just sends a malformed S/MIME, PKCS#7, or any CMS blob using AES-GCM, and the stack goes boom - crash or arbitrary code execution, depending on platform mitigations.
100+ Affected SKUs, From Routers to Drives to HMI Panels
Siemens' advisory lists nearly every networking and industrial control device they make. SCALANCE routers (M800, XR500, XC300 series), RUGGEDCOM RM1224 LTE gateways, SIMATIC HMI Comfort and Mobile Panels, SINAMICS drives G200/G220/S200/S210, SIMATIC WinCC SCADA systems, SITRANS sensors, and even the AI Lightweight Inference Server and SIMOVE Fleetmanager. Over 100 distinct part numbers, all tagged "known_affected" with version "all/*".
Some products already have patches. SINEC NMS needs update to V2.15.3.0; SIMATIC WinCC OA V3.21 needs P02; STEP 7 V5 needs SP4. Others like the SCALANCE LPE9403 and SIMATIC IPC BX-21A have no fix planned. Siemens tells those customers to restrict network access and avoid untrusted CMS content - a thin defense for a remotely exploitable stack overflow.
Why This Matters for Engineering Teams
This isn't a theoretical bug you read about in a white paper. OpenSSL is the TLS/crypto layer for thousands of embedded devices. The vulnerable path processes S/MIME encrypted email and any application that accepts CMS/PKCS#7 data. If a PLC, HMI, or industrial gateway receives an email or upload with a crafted CMS attachment, the stack overflow happens before OpenSSL even checks the key. No valid certificate or shared secret needed.
Siemens ProductCERT reported the vulnerability to CISA; the OpenSSL project fixed it in 3.6/3.5/3.4/3.3/3.0 releases (FIPS modules are clean because CMS lives outside the FIPS boundary). Any Siemens device still running stock OpenSSL 3.x from before the patch is exposed.
Inventory your industrial network for every device in that advisory. Prioritize patching anything that faces untrusted networks or handles email. For the unfixable devices, firewall them into a dark corner and audit all CMS traffic. A 9.8 that costs nothing to exploit doesn't wait for your next maintenance window.
Source: Siemens Products using OpenSSL
Domain: cisa.gov
Comments load interactively on the live page.