Answer in brief
CVE-2025-15467 records a High severity (CVSS 8.8) vulnerability in Stack buffer overflow in CMS (Auth)EnvelopedData parsing. The current sources do not mark it as known exploited. The current feed maps Siemens/AI Lightweight Inference Server (generic), Siemens/Connector for Azure (generic), Siemens/Databus (generic), Siemens/Desigo CC family V7 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Siemens/AI Lightweight Inference Server (generic), Siemens/Connector for Azure (generic), Siemens/Databus (generic), Siemens/Desigo CC family V7 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Siemens/AI Lightweight Inference Servergeneric | >=0 <* | * |
| Siemens/Connector for Azuregeneric | >=0 <V1.8.0 | V1.8.0 |
| Siemens/Databusgeneric | >=0 <V3.3.2 | V3.3.2 |
| Siemens/Desigo CC family V7generic | >=0 <* | * |
| Siemens/Desigo CC family V8generic | >=0 <* | * |
| Siemens/Desigo CC family V9generic | >=0 <V9.0 QU1 | V9.0 QU1, V9.0 |
| Siemens/HiMed Cockpitgeneric | >=0 <* | * |
| Red Hat/openshift/ose-rhel-coreos-9generic | * | Not reported |
| OpenSSL/OpenSSLgeneric | >=3.6.0 <3.6.1 || >=3.5.0 <3.5.5 || >=3.4.0 <3.4.4 || >=3.3.0 <3.3.6 || >=3.0.0 <3.0.19 | 3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19 |
| Siemens/RUGGEDCOM RM1224 LTE(4G) EUgeneric | >=0 <* | * |
| Siemens/RUGGEDCOM RM1224 LTE(4G) NAMgeneric | >=0 <* | * |
| Siemens/SCALANCE LPE9403generic | >=0 <* | * |
| Siemens/SCALANCE LPE9413generic | >=0 <* | * |
| Siemens/SCALANCE LPE9433generic | >=0 <* | * |
| Siemens/SCALANCE M804PBgeneric | >=0 <* | * |
| Siemens/SCALANCE M812-1 ADSL-Router familygeneric | >=0 <* | * |
| Siemens/SCALANCE M816-1 ADSL-Router familygeneric | >=0 <* | * |
| Siemens/SCALANCE M826-2 SHDSL-Routergeneric | >=0 <* | * |
| Siemens/SCALANCE M874-2generic | >=0 <* | * |
| Siemens/SCALANCE M874-3generic | >=0 <* | * |
| Siemens/SCALANCE M874-3 3G-Router (CN)generic | >=0 <* | * |
| Siemens/SCALANCE M876-3generic | >=0 <* | * |
| Siemens/SCALANCE M876-3 (ROK)generic | >=0 <* | * |
| Siemens/SCALANCE M876-4generic | >=0 <* | * |
| Siemens/SCALANCE M876-4 (EU)generic | >=0 <* | * |
| Siemens/SCALANCE M876-4 (NAM)generic | >=0 <* | * |
| Siemens/SCALANCE MUB852-1 (A1)generic | >=0 <* | * |
| Siemens/SCALANCE MUB852-1 (B1)generic | >=0 <* | * |
| Siemens/SCALANCE MUM853-1 (A1)generic | >=0 <* | * |
| Siemens/SCALANCE MUM853-1 (B1)generic | >=0 <* | * |
| Siemens/SCALANCE MUM853-1 (EU)generic | >=0 <* | * |
| Siemens/SCALANCE MUM856-1 (A1)generic | >=0 <* | * |
| Siemens/SCALANCE MUM856-1 (B1)generic | >=0 <* | * |
| Siemens/SCALANCE MUM856-1 (CN)generic | >=0 <* | * |
| Siemens/SCALANCE MUM856-1 (EU)generic | >=0 <* | * |
| Siemens/SCALANCE MUM856-1 (RoW)generic | >=0 <* | * |
| Siemens/SCALANCE S615 EEC LAN-Routergeneric | >=0 <* | * |
| Siemens/SCALANCE S615 LAN-Routergeneric | >=0 <* | * |
| Siemens/SCALANCE WAB762-1generic | >=0 <* | * |
| Siemens/SCALANCE WAM763-1generic | >=0 <* | * |
| Siemens/SCALANCE WAM763-1 (ME)generic | >=0 <* | * |
| Siemens/SCALANCE WAM763-1 (US)generic | >=0 <* | * |
| Siemens/SCALANCE WAM766-1generic | >=0 <* | * |
| Siemens/SCALANCE WAM766-1 EECgeneric | >=0 <* | * |
| Siemens/SCALANCE WAM766-1 EEC (ME)generic | >=0 <* | * |
| Siemens/SCALANCE WAM766-1 EEC (US)generic | >=0 <* | * |
| Siemens/SCALANCE WAM766-1 (ME)generic | >=0 <* | * |
| Siemens/SCALANCE WAM766-1 (US)generic | >=0 <* | * |
| Siemens/SCALANCE WUB762-1generic | >=0 <* | * |
| Siemens/SCALANCE WUB762-1 iFeaturesgeneric | >=0 <* | * |
| Siemens/SCALANCE WUM763-1generic | >=0 <* | * |
| Siemens/SCALANCE WUM763-1 (US)generic | >=0 <* | * |
| Siemens/SCALANCE WUM766-1generic | >=0 <* | * |
| Siemens/SCALANCE WUM766-1 (ME)generic | >=0 <* | * |
| Siemens/SCALANCE WUM766-1 (USA)generic | >=0 <* | * |
| Siemens/SCALANCE XC316-8generic | >=0 <* | * |
| Siemens/SCALANCE XC324-4generic | >=0 <* | * |
| Siemens/SCALANCE XC324-4 EECgeneric | >=0 <* | * |
| Siemens/SCALANCE XC332generic | >=0 <* | * |
| Siemens/SCALANCE XC416-8generic | >=0 <* | * |
| Siemens/SCALANCE XC424-4generic | >=0 <* | * |
| Siemens/SCALANCE XC432generic | >=0 <* | * |
| Siemens/SCALANCE XR302-32generic | >=0 <* | * |
| Siemens/SCALANCE XR322-12generic | >=0 <* | * |
| Siemens/SCALANCE XR326-8generic | >=0 <* | * |
| Siemens/SCALANCE XR326-8 EECgeneric | >=0 <* | * |
| Siemens/SCALANCE XR502-32generic | >=0 <* | * |
| Siemens/SCALANCE XR522-12generic | >=0 <* | * |
| Siemens/SCALANCE XR524-8WGgeneric | >=0 <* | * |
| Siemens/SCALANCE XR526-8generic | >=0 <* | * |
| Siemens/Shopfloor IT Suitegeneric | >=0 <* | * |
| Siemens/SIDIS Primegeneric | >=V4.0.700 <* | * |
| Siemens/Siemens OPC UA Modelling Editor (SiOME)generic | >=0 <* | * |
| Siemens/SIMATIC Comfort/Mobile RTgeneric | >=0 <* | * |
| Siemens/SIMATIC eaSie Core Packagegeneric | >=0 <* | * |
| Siemens/SIMATIC eaSie PCS 7 Skill Packagegeneric | >=0 <* | * |
| Siemens/SIMATIC HMI Basic Panelsgeneric | >=0 <V17.9 | V17.9 |
| Siemens/SIMATIC HMI Comfort Panelsgeneric | >=0 <V17.9 | V17.9 |
| Siemens/SIMATIC HMI Mobile Panelsgeneric | >=0 <V17 Update 9 | V17 Update 9, V17 |
| Siemens/SIMATIC IoT2050 Advancedgeneric | >=0 <* | * |
| Siemens/SIMATIC IPC BX-21Ageneric | >=0 <* | * |
| Siemens/SIMATIC IPC MD-57Ageneric | >=0 <* | * |
| Siemens/SIMATIC IPC ORCLAgeneric | >=0 <* | * |
| Siemens/SIMATIC Logon V1.6generic | >=0 <* | * |
| Siemens/SIMATIC Logon V1.6generic | >=0 <V1.6 Upd12 | V1.6 Upd12, V1.6 |
| Siemens/SIMATIC Logon V2.0generic | >=0 <* | * |
| Siemens/SIMATIC MV530 Hgeneric | >=0 <* | * |
| Siemens/SIMATIC MV530 Sgeneric | >=0 <* | * |
| Siemens/SIMATIC MV540 Hgeneric | >=0 <* | * |
| Siemens/SIMATIC MV540 H CRANESgeneric | >=0 <* | * |
| Siemens/SIMATIC MV540 Sgeneric | >=0 <* | * |
| Siemens/SIMATIC MV550 Hgeneric | >=0 <* | * |
| Siemens/SIMATIC MV550 Sgeneric | >=0 <* | * |
| Siemens/SIMATIC MV560 Ugeneric | >=0 <* | * |
| Siemens/SIMATIC MV560 Xgeneric | >=0 <* | * |
| Siemens/SIMATIC PCS neo V6.0generic | >=0 <* | * |
| Siemens/SIMATIC PDM V9.3generic | >=0 <* | * |
| Siemens/SIMATIC PDM V9.3generic | >=0 <V9.3 SP2 | V9.3 SP2, V9.3 |
| Siemens/SIMATIC RTLS Locating Managergeneric | >=0 <* | * |
| Siemens/SIMATIC STEP 7 V5generic | >=0 <V5.7 SP4 | V5.7 SP4, V5.7 |
| Siemens/SIMATIC Targetgeneric | >=0 <* | * |
| Siemens/SIMATIC WinCC OA V3.19generic | >=0 <V3.19 P024 | V3.19 P024, V3.19 |
| Siemens/SIMATIC WinCC OA V3.20generic | >=0 <V3.20 P012 | V3.20 P012, V3.20 |
| Siemens/SIMATIC WinCC OA V3.21generic | >=0 <V3.21 P02 | V3.21 P02, V3.21 |
| Siemens/SIMATIC WinCC Runtime Advanced V17generic | >=0 <V17 Update 9 | V17 Update 9, V17 |
| Siemens/SIMATIC WinCC Unified Sequencegeneric | >=0 <V21 | V21 |
| Siemens/SIMATIC WinCC V7.5generic | >=0 <* | * |
| Siemens/SIMATIC WinCC V8.0generic | >=0 <* | * |
| Siemens/SIMATIC WinCC V8.1generic | >=0 <* | * |
| Siemens/SIMOTION OACAMGENgeneric | >=0 <* | * |
| Siemens/SIMOVE Fleetmanager V3.1generic | >=0 <V3.1.13 | V3.1.13 |
| Siemens/SIMOVE Fleetmanager V3.2generic | >=0 <V3.2.4 | V3.2.4 |
| Siemens/SIMOVE Fleetmanager V3.3generic | >=0 <V3.3.2 | V3.3.2 |
| Siemens/SINAMICS G200generic | >=V6.3 <* | * |
| Siemens/SINAMICS G220generic | >=V6.3 <* | * |
| Siemens/SINAMICS S200generic | >=V6.3 <* | * |
| Siemens/SINAMICS S210generic | >=V6.3 <* | * |
| Siemens/SINAMICS S220generic | >=V6.3 <* | * |
| Siemens/SINEC INSgeneric | >=0 <V1.0 SP2 Update 5 | V1.0 SP2 Update 5, V1.0 |
| Siemens/SINEC NMSgeneric | >=0 <* | * |
| Siemens/SINEC Security Monitorgeneric | >=0 <* | * |
| Siemens/SINUMERIK Access MyMachine /OPC UAgeneric | >=0 <V4.2 SP3 | V4.2 SP3, V4.2 |
| Siemens/SIPLANTgeneric | >=0 <* | * |
| Siemens/SITRANS ASM IQgeneric | >=0 <* | * |
| Siemens/SITRANS Soft Sensor Engine IQ (SITRANS SSE IQ)generic | >=0 <* | * |
| Siemens/User Management Component (UMC)generic | >=0 <V2.15.3.0 | V2.15.3.0 |
| Siemens/Visual Inspection Cockpitgeneric | >=0 <* | * |
Published upstream
Jan 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 14, 2026
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
Quoted source text, attributed separately from HOL analysis.