CyberSecBulletin
CVE-2025-9230NVD status: Analyzed

OpenSSL: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2025-9230 is a critical-severity out-of-bounds read vulnerability in OpenSSL, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 3.5.4, 3.4.3, 3.3.5 as the first without the flaw, so updating OpenSSL to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.78% chance of exploitation within 30 days, higher than 79% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update OpenSSL to 3.5.4 or 3.4.3 or 3.3.5 or 3.2.6, whichever matches your release line, or a later version.
  2. Update RUGGEDCOM RST2428P to V3.3 or V4.0, whichever matches your release line, or a later version.
  3. Update SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family to V3.3 or a later version.
  4. Read the advisory on openssl-library.org for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
OpenSSLOpenSSL3.5.0 up to, but not including, 3.5.4; 3.4.0 up to, but not including, 3.4.3; 3.3.0 up to, but not including, 3.3.5; 3.2.0 up to, but not including, 3.2.6; 3.0.0 up to, but not including, 3.0.18; 1.1.1 up to, but not including, 1.1.1zd; 1.0.2 up to, but not including, 1.0.2zm3.5.4, 3.4.3, 3.3.5, 3.2.6, 3.0.18, 1.1.1zd
SiemensRUGGEDCOM RST2428Pbefore V3.3; before V4.0V3.3, V4.0
SiemensSCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 familybefore V3.3V3.3
SiemensSCALANCE XCH328before V3.3V3.3
SiemensSCALANCE XCM324before V3.3V3.3
SiemensSCALANCE XCM328before V3.3V3.3
SiemensSCALANCE XCM332before V3.3V3.3
SiemensSCALANCE XRH334 (24 V DC, 8xFO, CC)before V3.3V3.3
SiemensSCALANCE XRM334 (230 V AC, 12xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (230 V AC, 8xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)before V3.3V3.3
SiemensSCALANCE XRM334 (24 V DC, 12xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (24 V DC, 8xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)before V3.3V3.3
SiemensSCALANCE XRM334 (2x230 V AC, 12xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (2x230 V AC, 8xFO)before V3.3V3.3
SiemensSCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)before V3.3V3.3
SiemensSIDIS Primebefore V4.0.800V4.0.800
SiemensSIDIS Secured SmartPlugbefore V7.26.0310V7.26.0310
SiemensSIMATIC CN 4100before V5.0V5.0
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.5 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.5 and laterNot stated
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystembefore V1.1.1V1.1.1
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.5 and laterNot stated
DebianDebian Linux11.0Not stated

Version data comes from the organisation that assigned the CVE; 5 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in OpenSSL

All OpenSSL vulnerabilities

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.