Siemens SIDIS Secured SmartPlug Vulnerabilities

Vulnerabilities Overview

CISA has identified multiple vulnerabilities in Siemens SIDIS Secured SmartPlug, including improper enforcement of message integrity, reuse of nonces, and out-of-bounds writes. These vulnerabilities affect various components, including OpenSSL, OpenSSH, and several other packages.

CVE-2022-23303: Side Channel Attacks

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9494.

CVE-2022-23304: Side-Channel Attacks

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9495.

CVE-2022-37660: PKEX Association

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.

CVE-2022-48174: Stack Overflow Vulnerability

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

CVE-2025-5222: Stack Buffer Overflow

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

CVE-2025-5914: Integer Overflow

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.