جزئیات آسیب‌پذیری
CVE-2025-15467
OpenSSL OpenSSLRed Hat OpenShift Container Platform 4Siemens AI Lightweight Inference ServerSiemens Connector for AzureSiemens DatabusSiemens Desigo CC family V7
Stack buffer overflow in CMS (Auth)EnvelopedData parsing
CVSS 3.1
9.8بحرانی
شرح رسمی (انگلیسی)
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.8بالا | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 9.8بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| OpenSSL | OpenSSL | 3.0.0 ≤ v < 3.0.19 | CVEProject cvelistV5 (CNA) |
| OpenSSL | OpenSSL | 3.3.0 ≤ v < 3.3.6 | CVEProject cvelistV5 (CNA) |
| OpenSSL | OpenSSL | 3.4.0 ≤ v < 3.4.4 | CVEProject cvelistV5 (CNA) |
| OpenSSL | OpenSSL | 3.5.0 ≤ v < 3.5.5 | CVEProject cvelistV5 (CNA) |
| OpenSSL | OpenSSL | 3.6.0 ≤ v < 3.6.1 | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | AI Lightweight Inference Server | همه | CVEProject cvelistV5 (CNA) |
| Siemens | Connector for Azure | v < V1.8.0 | CVEProject cvelistV5 (CNA) |
| Siemens | Databus | v < V3.3.2 | CVEProject cvelistV5 (CNA) |
| Siemens | Desigo CC family V7 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | Desigo CC family V8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | Desigo CC family V9 | v < V9.0 QU1 | CVEProject cvelistV5 (CNA) |
| Siemens | HiMed Cockpit | همه | CVEProject cvelistV5 (CNA) |
| Siemens | RUGGEDCOM RM1224 LTE(4G) EU | همه | CVEProject cvelistV5 (CNA) |
| Siemens | RUGGEDCOM RM1224 LTE(4G) NAM | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE LPE9403 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE LPE9413 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE LPE9433 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M804PB | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M812-1 ADSL-Router family | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M816-1 ADSL-Router family | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M826-2 SHDSL-Router | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M874-2 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M874-3 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M874-3 3G-Router (CN) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-3 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-3 (ROK) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-4 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-4 (EU) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE M876-4 (NAM) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUB852-1 (A1) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUB852-1 (B1) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM853-1 (A1) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM853-1 (B1) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM853-1 (EU) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (A1) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (B1) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (CN) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (EU) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE MUM856-1 (RoW) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE S615 EEC LAN-Router | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE S615 LAN-Router | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAB762-1 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM763-1 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM763-1 (ME) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM763-1 (US) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 (ME) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 (US) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 EEC | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 EEC (ME) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WAM766-1 EEC (US) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUB762-1 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUB762-1 iFeatures | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM763-1 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM763-1 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM763-1 (US) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM763-1 (US) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM766-1 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM766-1 (ME) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE WUM766-1 (USA) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC316-8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC324-4 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC324-4 EEC | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC332 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC416-8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC424-4 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XC432 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR302-32 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR302-32 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR302-32 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR322-12 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR322-12 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR322-12 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR326-8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR326-8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR326-8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR326-8 EEC | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR502-32 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR502-32 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR502-32 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR522-12 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR522-12 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR522-12 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR524-8WG | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR524-8WG | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR524-8WG | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR524-8WG | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR526-8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR526-8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SCALANCE XR526-8 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIDIS Prime | V4.0.700 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC IPC BX-21A | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC IPC MD-57A | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC IPC ORCLA | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC IoT2050 Advanced | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC Logon V1.6 | v < V1.6 Upd12 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC Logon V2.0 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV530 H | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV530 S | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV540 H | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV540 H CRANES | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV540 S | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV550 H | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV550 S | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV560 U | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC MV560 X | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC PCS neo V6.0 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC PDM V9.3 | v < V9.3 SP2 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC RTLS Locating Manager | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC STEP 7 V5 | v < V5.7 SP4 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC Target | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC OA V3.19 | v < V3.19 P024 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC OA V3.20 | v < V3.20 P012 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC OA V3.21 | v < V3.21 P02 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC Runtime Advanced V17 | v < V17 Update 9 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC Unified Sequence | v < V21 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC V7.5 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC V8.0 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC WinCC V8.1 | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC eaSie Core Package | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMATIC eaSie PCS 7 Skill Package | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMOTION OACAMGEN | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SIMOVE Fleetmanager V3.1 | v < V3.1.13 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMOVE Fleetmanager V3.2 | v < V3.2.4 | CVEProject cvelistV5 (CNA) |
| Siemens | SIMOVE Fleetmanager V3.3 | v < V3.3.2 | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS G200 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS G220 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS S200 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS S210 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINAMICS S220 | V6.3 ≤ v | CVEProject cvelistV5 (CNA) |
| Siemens | SINEC INS | v < V1.0 SP2 Update 5 | CVEProject cvelistV5 (CNA) |
| Siemens | SINEC NMS | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SINEC Security Monitor | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SINUMERIK Access MyMachine /OPC UA | v < V4.2 SP3 | CVEProject cvelistV5 (CNA) |
| Siemens | SIPLANT | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SITRANS ASM IQ | همه | CVEProject cvelistV5 (CNA) |
| Siemens | SITRANS Soft Sensor Engine IQ (SITRANS SSE IQ) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | Shopfloor IT Suite | همه | CVEProject cvelistV5 (CNA) |
| Siemens | Siemens OPC UA Modelling Editor (SiOME) | همه | CVEProject cvelistV5 (CNA) |
| Siemens | User Management Component (UMC) | v < V2.15.3.0 | CVEProject cvelistV5 (CNA) |
| Siemens | Visual Inspection Cockpit | همه | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۴۰- https://openssl-library.org/news/secadv/20260127.txt vendor-advisory
- https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703 patch
- https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc patch
- https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3 patch
- https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9 patch
- https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e patch
- http://www.openwall.com/lists/oss-security/2026/01/27/10
- http://www.openwall.com/lists/oss-security/2026/02/25/6
- https://github.com/guiimoraes/CVE-2025-15467 exploit
- https://cert-portal.siemens.com/productcert/html/ssa-434797.html
- https://cert-portal.siemens.com/productcert/html/ssa-734552.html
- https://access.redhat.com/security/cve/CVE-2025-15467 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2430376 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3415 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2974 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4419 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2659 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2671 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2072 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2633 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2077 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6481 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1496 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1472 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1733 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1594 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1519 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1503 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1473 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3228 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3461 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3462 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1736 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7261 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2485 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2995 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2844 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4943 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2563 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۱/۰۷
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۷/۲۳
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- openssl
پیش‌بینی بهره‌برداری (EPSS)
۷۴٫۷۹٪
احتمال بهره‌برداری در ۳۰ روز
۹۹٫۵٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-787Out-of-bounds Write
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')