CISA 2026-06-23

Siemens Products using OpenSSL

CVE-2025-15467

Machine-generated analysis · WAYSCloud LLM

The vulnerability affects multiple Siemens industrial communication products using OpenSSL, with a focus on router and server devices used in network infrastructure.

Context

The advisory covers various Siemens products that incorporate OpenSSL, including industrial routers, data bus systems, and inference servers. The affected products are vulnerable to a stack-based buffer overflow due to an issue in OpenSSL, which could lead to denial of service or potential remote code execution. Siemens has released updates for some products and is preparing fixes for others. For products without available updates, specific countermeasures are recommended by the vendor.

Operator considerations

Check: inventory all Siemens products listed in the advisory, particularly SCALANCE, RUGGEDCOM, and AI Lightweight Inference Server instances. Patch: update to the latest product versions where fixes are available, especially for Connector for Azure and Databus. Isolate: restrict network access to affected devices where updates are not yet available. Log: monitor network traffic for unusual activity targeting OpenSSL services on these devices.

From Cybersecurity and Infrastructure Security Agency ↗

OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

The following versions of Siemens Products using OpenSSL are affected:

AI Lightweight Inference Server vers:all/* (CVE-2025-15467)

Connector for Azure vers:intdot/

Read the full advisory on CISA →