Siemens SIDIS SmartPlug hit by multiple CVEs
Siemens SIDIS Secured SmartPlug before V7.26.0310 bundles vulnerable OpenSSL, OpenSSH, hostapd, busybox, libarchive and sudo components; Siemens urges upgrading to fix them.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 12 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2025-32462 (weaponized); no exploitation in the wild is recorded.
CISA republished a Siemens ProductCERT advisory (SSA-585531) detailing a dozen third-party component vulnerabilities affecting SIDIS Secured SmartPlug versions prior to V7.26.0310, a product used in Critical Manufacturing environments deployed worldwide. The issues stem from outdated bundled open-source components including OpenSSL, OpenSSH, hostapd/wpa_supplicant, busybox, libarchive, and sudo, covering a range of weaknesses from side-channel key recovery and memory corruption to authorization bypass and denial-of-service conditions.
Notable flaws include CVE-2022-48174 (busybox stack overflow enabling arbitrary code execution), CVE-2025-5914 and CVE-2026-5121 (libarchive integer overflow/double-free issues that could lead to code execution via crafted archive or ISO images), and CVE-2025-32462 (a sudo authorization flaw allowing execution on unintended hosts). Several OpenSSL and OpenSSH CVEs (side-channel timing attacks, out-of-bounds reads/writes, and a VerifyHostKeyDNS MITM weakness) round out the set, though most carry high attack complexity or narrow applicability.
No active exploitation has been reported; this is a vendor-driven patch advisory. Siemens recommends updating to V7.26.0310 or later and following standard industrial network segmentation and hardening guidance (isolating control system networks, avoiding direct internet exposure, and using VPNs for remote access) as compensating controls where immediate patching is not feasible.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-202-04
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs