Siemens Rushes Fix for Smart Plug Riddled With Eight Serious Flaws

Key points

• Siemens has patched eight vulnerabilities in its SIDIS Secured SmartPlug, all fixed in version V7.26.0310, released via a coordinated advisory with CISA.
• The most serious flaw, CVE-2022-23303, carries a critical CVSS score of 9.8 and lets a network attacker hit the device with no login required.
• Bugs sit in open-source components including OpenSSL, hostapd, wpa_supplicant, BusyBox, libarchive and ICU.
• The device is deployed worldwide across critical manufacturing sites, according to CISA's advisory.
• CVE-2025-5222 and CVE-2025-5914 can lead to arbitrary code execution on the plug itself.

Siemens has issued a fix for its SIDIS Secured SmartPlug after eight security holes were found in the device, one rated critical. Any unit running firmware below V7.26.0310 is affected, and the German manufacturer is telling customers to update now.

The advisory came through CISA, the US Cybersecurity and Infrastructure Security Agency, which coordinates disclosures for industrial gear. It's worth comparing to Siemens' RUGGEDCOM advisory in July, where the top-rated bug also hit 9.8: Siemens has kept its security teams busy this quarter.

What is actually broken on this device?

None of the flaws are in code Siemens wrote itself. They sit in open-source components the plug uses to handle Wi-Fi connections, encryption and file handling.

The headline bug is CVE-2022-23303, scored 9.8 out of 10. It affects the SAE handshake in hostapd and wpa_supplicant, the software managing secure Wi-Fi connections. A nearby attacker can use timing patterns in the chip's memory cache to extract secrets. A related bug, CVE-2022-23304, does the same against the EAP-pwd login method; its score is 7.0.

Then there's CVE-2022-37660, a flaw in how hostapd pairs devices with a shared code. An attacker who watched an earlier pairing can quietly hijack the next one.

BusyBox, a tiny toolkit found in almost every embedded device, contributes CVE-2022-48174: a stack overflow, scored 7.8, where attacker input runs past the end of a memory buffer and can be turned into code execution.

The ICU text library brings CVE-2025-5222, a stack buffer overflow leading to local code execution. Libarchive adds CVE-2025-5914: an integer overflow that tips into a double-free condition, where the same memory chunk is released twice and can be turned into a crash or arbitrary code execution.

OpenSSL contributes two more. CVE-2025-9230 triggers an out-of-bounds read and write when decrypting certain password-protected messages, scored 7.5. CVE-2025-9231 exploits a timing side channel in the SM2 signature routine on 64-bit ARM chips; measuring how long operations take could let an attacker recover a private key. We covered a separate OpenSSL denial-of-service flaw on 17 July in "An 11-byte message can knock OpenSSL servers offline", a reminder that this library keeps giving defenders work to do.

Should operators be worried?

Yes, but the fix is simple. Update every SIDIS Secured SmartPlug to V7.26.0310 or later. One step closes all eight issues.

The critical Wi-Fi flaws matter most for plugs on wireless networks near untrusted spaces. A shared factory floor or warehouse loading bay should be treated as exposed until patched. The local code execution bugs need some prior access, but industrial devices get chained: one foothold becomes a bigger one.

What operators should do now

Pull an inventory of every SIDIS Secured SmartPlug on site and check the firmware version. Anything below V7.26.0310 needs updating. Keep these devices off the general corporate network where possible and restrict which machines can reach them. Can't patch immediately? Isolate affected plugs behind a firewall and watch for unusual traffic.