Desigo CC V7 stranded as Siemens patches OpenSSL RCE in V8, V9

CVE-2025-15467 is a stack buffer overflow in OpenSSL's parsing of CMS AuthEnvelopedData messages that use AEAD ciphers such as AES-GCM. When OpenSSL processes a crafted CMS message with an oversized Initialization Vector, it writes past the bounds of a fixed-size stack buffer before any authentication or tag verification occurs. No valid key material is needed to trigger the overflow. The result, depending on platform mitigations, is denial of service or remote code execution. The CVSS vector assigned to Desigo CC is 9.8, network-exploitable, low complexity, no privileges, no user interaction.

Siemens confirmed that Desigo CC V7 (all versions), V8 (all versions), and V9 prior to 9.0.1 are affected. V9 users can update to V9.0 QU1 or later. V8 users can apply patch V8.0 QU2.0021. For V7, Siemens lists no available fix. The advisory offers no timeline for one.

The asymmetry is the operational problem. V8 and V9 deployments have a clear remediation path. V7 deployments (which Siemens lists with the status "known_affected" and the remediation "None available / Currently no fix is available") have only the general network-level mitigations Siemens and CISA recommend for all ICS environments: firewalls, segmentation, VPNs, and isolation from the business network and internet. Those measures reduce exposure but don't close the vulnerability. Any Desigo CC V7 server whose CMS parsing path is reachable from an untrusted network segment remains exposed to the overflow.

Desigo CC is a building automation platform deployed worldwide across critical manufacturing and other sectors. The platform has appeared in CISA ICS advisories repeatedly: a 9.8-rated code injection in 2020 (ICSA-20-224-06), a 9.8 client-side authentication flaw in 2022 (ICSA-22-286-16), buffer over-reads and heap overflows via third-party CodeMeter in 2023 (ICSA-23-320-03), and a missing-authentication SQL injection in 2025 (ICSA-25-135-04). What distinguishes this advisory isn't the severity, it's that one full major version gets no fix while the other two do.

For V8 users, the instruction is straightforward: apply patch V8.0 QU2.0021, validate in a test environment first per Siemens's recommendation, and verify the underlying OpenSSL instance no longer parses untrusted CMS structures with the vulnerable code path. For V7 users, the immediate step is to audit whether the Desigo CC server's CMS parsing path is reachable from any network segment that isn't fully trusted, and to harden segmentation until Siemens ships a fix. CISA's standard ICS guidance (minimize network exposure, isolate control system networks behind firewalls, use VPNs for remote access) applies with more urgency than usual here, because the vulnerability requires no credentials to trigger.