SSA-408105 V1.3 (Last Update: 2025-12-09): Buffer Overflow Vulnerabilities in OpenSSL 3.0 Affecting Siemens Products

Risk Summary

<p>The openSSL component, versions 3.0.0 through 3.0.6, contains two buffer overflow vulnerabilities (CVE-2022-3602, CVE-2022-3786) in the X.509 certificate verification [0]. They could allow an attacker to create a denial of service condition or execute arbitrary code on a vulnerable TLS server (if the server requests client certificate authentication), or on a vulnerable TLS client.</p> <p>Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.</p> <p>[0] <a href="https://www.openssl.org/news/secadv/20221101.txt" class="uri">https://www.openssl.org/news/secadv/20221101.txt</a></p>

CVEs (2)

Remediations

• Refer to Siemens ProductCERT advisory for patch and remediation guidance.

Affected Vendors

Affected Products (1)