Siemens Rushes Fix for Smart Plug Riddled With Eight Serious Flaws

Key points

• Siemens has patched eight vulnerabilities in its SIDIS Secured SmartPlug, all fixed in version V7.26.0310, released via a coordinated advisory with CISA.
• The most serious flaw, CVE-2022-23303, carries a critical CVSS score of 9.8 and lets an attacker on the network attack the device without any login.
• Bugs sit in widely used open-source components including OpenSSL, hostapd, wpa_supplicant, BusyBox, libarchive and ICU.
• The device is deployed worldwide across critical manufacturing sites, according to CISA's advisory.
• Two flaws (CVE-2025-5222 and CVE-2025-5914) can lead to arbitrary code execution on the plug itself.

Siemens has issued a fix for its SIDIS Secured SmartPlug after researchers found eight security holes in the device, one of them rated critical. Any unit running firmware older than V7.26.0310 is affected, and the German manufacturer is telling customers to update immediately.

The advisory was published through CISA, the US Cybersecurity and Infrastructure Security Agency, which coordinates disclosures for industrial gear used in factories, power plants and other critical sites. CISA notes the smart plug is deployed worldwide in critical manufacturing.

What is actually broken on this device?

None of the flaws are in code Siemens wrote from scratch. They sit in the open-source building blocks the plug uses to handle Wi-Fi, encryption, file archives and text.

The headline bug is CVE-2022-23303, scored 9.8 out of 10. It affects the SAE handshake in hostapd and wpa_supplicant, the software that manages secure Wi-Fi connections. A nearby attacker can use timing patterns in the chip's memory cache to work out secrets they should not see. A related bug, CVE-2022-23304, does the same trick against the EAP-pwd login method.

Then there is CVE-2022-37660, a flaw in the way hostapd pairs devices with a shared code. If an attacker watched an earlier pairing, they can quietly hijack the next one.

BusyBox, a tiny toolkit found in almost every embedded device, contributes CVE-2022-48174. That one is a stack overflow, meaning attacker input runs off the end of a memory buffer and can be turned into code execution. Score: 7.8.

The ICU text library brings CVE-2025-5222, another buffer overflow leading to local code execution. Libarchive adds CVE-2025-5914, a double-free bug where the same chunk of memory is released twice, which attackers can turn into a crash or code execution.

OpenSSL, the encryption library behind most of the internet, contributes two more. CVE-2025-9230 is an out-of-bounds read and write when decrypting certain password-protected messages. CVE-2025-9231 is a timing side channel in the SM2 signature routine on 64-bit ARM chips that could let an attacker recover a private key by measuring how long operations take.

Should operators be worried?

Yes, but the fix is straightforward. Update every SIDIS Secured SmartPlug to V7.26.0310 or later. That single step closes all eight issues.

The critical Wi-Fi flaws matter most for plugs sitting on wireless networks near untrusted spaces. A shared factory floor, a warehouse loading bay, or any site where someone can get within radio range should be treated as exposed until patched.

The local code execution bugs (BusyBox, ICU, libarchive) need an attacker to already have some access. They are still worth closing, because industrial devices often get chained: one small foothold becomes a bigger one.

What operators should do now

Pull an inventory of every SIDIS Secured SmartPlug on site and check the firmware version. Anything below V7.26.0310 needs updating. Keep these devices off the general corporate network where possible, and restrict which machines can talk to them. If you cannot patch immediately, isolate the affected plugs behind a firewall and monitor for unusual traffic to and from them.