CVE-2025-2884

mediumPriorität · verfolgen · 0EPSS 0.003 · 16. PerzentilDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.26% (16th) EPSS

CVSS 6.6 · medium

Is it mine?

278 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-23

TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC Field PG M6siemens_psirt
Update to V26.01.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC BX-32Asiemens_psirt
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC BX-39Asiemens_psirt
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC BX-56Asiemens_psirt
Update to V32.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC BX-59Asiemens_psirt
Update to V32.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC MD-57Asiemens_psirt
Update to V30.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC PX-32Asiemens_psirt
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC PX-39Asiemens_psirt
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC PX-39A PROsiemens_psirt
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC RW-528Asiemens_psirt
Update to V34.01.02 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC RW-548Asiemens_psirt
Update to V34.01.02 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC427Esiemens_psirt
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC477Esiemens_psirt
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC477E Prosiemens_psirt
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC627Esiemens_psirt
Update to V25.02.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC647Esiemens_psirt
Update to V25.02.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC677Esiemens_psirt
Update to V25.02.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC847Esiemens_psirt
Update to V25.02.16 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIPLUS IPC427Esiemens_psirt
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC BX-32Acisa_csaf_ot
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC BX-39Acisa_csaf_ot
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC BX-56Acisa_csaf_ot
Update to V32.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC BX-59Acisa_csaf_ot
Update to V32.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC MD-57Acisa_csaf_ot
Update to V30.01.10 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC PX-32Acisa_csaf_ot
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC PX-39Acisa_csaf_ot
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC PX-39A PROcisa_csaf_ot
Update to V29.01.09 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC RW-528Acisa_csaf_ot
Update to V34.01.02 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC RW-548Acisa_csaf_ot
Update to V34.01.02 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC427Ecisa_csaf_ot
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC477Ecisa_csaf_ot
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIMATIC IPC477E Procisa_csaf_ot
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
BehobenSIPLUS IPC427Ecisa_csaf_ot
Update to V21.01.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
Kein Fix verfügbarSIMATIC Field PG M5cisa_csaf_ot
Currently no fix is available
Kein Fix verfügbarSIMATIC Field PG M6cisa_csaf_ot
Currently no fix is available
Kein Fix verfügbarSIMATIC IPC627Ecisa_csaf_ot
Currently no fix is available
Kein Fix verfügbarSIMATIC IPC647Ecisa_csaf_ot
Currently no fix is available
Kein Fix verfügbarSIMATIC IPC677Ecisa_csaf_ot
Currently no fix is available
Kein Fix verfügbarSIMATIC IPC847Ecisa_csaf_ot
Currently no fix is available
Kein Fix verfügbarSIMATIC ITP1000cisa_csaf_ot
Currently no fix is available
Kein Fix geplantSIMATIC CN 4100siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC Field PG M5siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC IPC227Esiemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC IPC277Esiemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC ITP1000siemens_psirt
Currently no fix is planned
Kein Fix geplantSIMATIC CN 4100cisa_csaf_ot
Currently no fix is planned
Kein Fix geplantSIMATIC IPC227Ecisa_csaf_ot
Currently no fix is planned
Kein Fix geplantSIMATIC IPC277Ecisa_csaf_ot
Currently no fix is planned

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.6

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Hsecondary · CISA US

v3.16.6mediumAV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Hsecondary · ENISA EU

v3.16.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:HsecondaryAusnutzbarkeit 1.3 · Auswirkung 5.2

v3.16.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Hsecondary · Siemens ProductCERT DE

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.16.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Hsecondary · NCSC-NL NL

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-125USCWE-125USCWE-125USCWE-125USCWE-125US

betroffene Produkte (278)

Betroffene Produkte und Versionsbereiche.

AMD Prozessor Athlonalle Versionencert_bundDEcpe:/h:amd:amd_processor:athlon
AMD Prozessor Ryzenalle Versionencert_bundDEcpe:/h:amd:amd_processor:ryzen
Dell BIOSalle Versionencert_bundDEcpe:/h:dell:bios:-
Dell Computeralle Versionencert_bundDEcpe:/o:dell:dell_computer:-
Dell PowerEdgealle Versionencert_bundDEcpe:/h:dell:poweredge:-
HP Computeralle Versionencert_bundDEcpe:/h:hp:computer:-
Intel Firmware PTTalle Versionencert_bundDEcpe:/a:intel:firmware:ptt
Intel Firmware SPSalle Versionencert_bundDEcpe:/a:intel:firmware:sps
Lenovo Computeralle Versionencert_bundDEcpe:/h:lenovo:computer:-
NetApp Data ONTAP 9alle Versionencert_bundDEcpe:/a:netapp:data_ontap:9
SIMATIC CN 4100alle Versionencisa_csaf_otUS
SIMATIC Field PG M5alle Versionencisa_csaf_otUS
SIMATIC Field PG M6alle Versionencisa_csaf_otUS
SIMATIC IPC BX-32Aalle Versionencisa_csaf_otUS
SIMATIC IPC BX-39Aalle Versionencisa_csaf_otUS
SIMATIC IPC BX-56Aalle Versionencisa_csaf_otUS
SIMATIC IPC BX-59Aalle Versionencisa_csaf_otUS
SIMATIC IPC MD-57Aalle Versionencisa_csaf_otUS
SIMATIC IPC PX-32Aalle Versionencisa_csaf_otUS
SIMATIC IPC PX-39Aalle Versionencisa_csaf_otUS

20 von 278 angezeigt

Advisories (8)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2025-0310Kwetsbaarheden verholpen in Microsoft WindowsNL2025-10-14csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in Windows.
NCSC-2025-0357Kwetsbaarheden verholpen in Siemens productenNL2025-11-11csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Altair Grid Engine, COMOS, LOGO, SICAM, SIDOOR, SIMATIC, SIPLUS, Spectrum Power en Solid Edge.
NCSC-2026-0112Kwetsbaarheden verholpen in Siemens productenNL2026-04-14csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Analytics Toolkit, Ruggedcom, Industrial Edge Management Pro, SIDIS en TPM.
SSA-628843SSA-628843: Out of Bound Read Vulnerability in TPM 2.02026-04-14csaf · siemens_psirtDE
The products listed below contain a vulnerability that could allow an attacker to perform an out-of-bound read, potentially leading to information disclosure or denial of service of the TPM. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
WID-SEC-W-2025-1278AMD Prozessoren: Schwachstelle ermöglicht Denial of Service und Offenlegung von InformationenDeutsch2025-06-10csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in verschiedenen AMD Prozessoren ausnutzen, um einen Denial of Service Angriff durchzuführen oder Infromationen offenzulegen.
WID-SEC-W-2025-1280Intel Firmware: Schwachstelle ermöglicht Denial of ServiceDeutsch2025-06-10csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Intel Firmware ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2025-2307Microsoft Windows: Mehrere SchwachstellenDeutsch2025-10-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Windows Server, Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows 10, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows, Microsoft Windows Server 2022, Microsoft Windows 11 und Microsoft Windows Server 2025 ausnutzen, um Remote Code Execution, Privilegieneskalation, Datenexfiltration oder Systemabstürze zu verursachen.
ICSA-26-111-01Siemens TPM 2.02026-04-14icsa · cisa_csaf_otUS
The products listed below contain a vulnerability that could allow an attacker to perform an out-of-bound read, potentially leading to information disclosure or denial of service of the TPM. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

veröffentlicht 2025-06-10geändert 2026-10-15

Referenzen (23)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan