Siemens SIDIS Secured SmartPlug: 12 CVEs, Critical 9.8
Summary
CISA reports 12 vulnerabilities in Siemens SIDIS Secured SmartPlug. Weakness types: Improper Enforcement of Message Integrity During Transmission in a Communication Channel, Reusing a Nonce, Key Pair in Encryption, Out-of-bounds Write (+6 more). SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- SIDIS Secured SmartPlug
- CVEs
- CVE-2022-23303, CVE-2022-23304, CVE-2022-37660, CVE-2022-48174, CVE-2025-5222, CVE-2025-5914, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-26465, CVE-2025-32462, CVE-2026-5121
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2022-23303 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel | 9.8 | – | No | CVE-2022-23303 |
| CVE-2022-23304 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel | 7.0 | – | No | CVE-2022-23304 |
| CVE-2022-37660 | Reusing a Nonce, Key Pair in Encryption | 6.5 | – | No | CVE-2022-37660 |
| CVE-2022-48174 | Out-of-bounds Write | 7.8 | – | No | CVE-2022-48174 |
| CVE-2025-5222 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 7.0 | – | No | CVE-2025-5222 |
| CVE-2025-5914 | Integer Overflow or Wraparound | 7.8 | – | No | CVE-2025-5914 |
| CVE-2025-9230 | Out-of-bounds Read | 7.5 | – | No | CVE-2025-9230 |
| CVE-2025-9231 | Covert Timing Channel | 6.5 | – | No | CVE-2025-9231 |
| CVE-2025-9232 | Out-of-bounds Read | 5.9 | – | No | CVE-2025-9232 |
| CVE-2025-26465 | Detection of Error Condition Without Action | 6.8 | – | No | CVE-2025-26465 |
| CVE-2025-32462 | Incorrect Authorization | 2.8 | – | No | CVE-2025-32462 |
| CVE-2026-5121 | Integer Overflow or Wraparound | 7.5 | – | No | CVE-2026-5121 |
Affected products (1)
- SIDIS Secured SmartPlug < V7.26.0310
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to V7.26.0310 or later version
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-202-04
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-585531.json
- https://cert-portal.siemens.com/productcert/html/ssa-585531.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.