# Siemens SIDIS Secured SmartPlug Carries a Stack of Unpatched CVEs Into Critical Infrastructure


## The Threat


Siemens has issued an advisory for its SIDIS Secured SmartPlug — an industrial smart outlet used in critical manufacturing environments worldwide — disclosing a cluster of vulnerabilities spanning OpenSSL, OpenSSH, BusyBox, and wireless authentication subsystems. The flaws range from side-channel attacks against Wi-Fi authentication protocols to a classic stack overflow in BusyBox, with one CVE scoring a perfect 9.8 on the CVSS scale. All versions prior to V7.26.0310 are affected.


What makes this advisory particularly notable is the combination of vulnerability classes present in a single device. You have cryptographic nonce reuse, cache-timing side channels against WPA3 SAE and EAP-pwd, a PKEX key bootstrapping flaw that can let an attacker silently compromise future associations, and memory corruption bugs in embedded firmware components. This isn't a single oversight — it's a backlog. Several of these CVEs date to 2022, meaning some of these weaknesses have existed in deployed devices for years before the patch landed.


The SmartPlug sits at the physical edge of industrial control environments: power monitoring, load management, and energy reporting in facilities that may also house manufacturing automation. An attacker with wireless adjacency — or network access — has a meaningful attack surface against a device that is by design always on and often overlooked in asset inventories.


## Severity and Impact


| CVE | CVSS Score | Severity | Vector String | CWE |

|---|---|---|---|---|

| CVE-2022-23303 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-924 |

| CVE-2022-48174 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CWE-787 |

| CVE-2022-23304 | 7.0 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | CWE-924 |

| CVE-2022-37660 | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CWE-323 |

| CVE-2025-5222 | TBD | TBD | Stack buffer overflow (details truncated in source) | CWE-121 (expected) |


Attack complexity note: CVE-2022-23303 requires no authentication, no user interaction, and is remotely exploitable — the worst-case combination for an internet-adjacent or LAN-exposed device.


## Affected Products


  • Siemens SIDIS Secured SmartPlug — all versions prior to V7.26.0310

    • - Deployed globally across critical manufacturing sectors

    - Headquartered: Germany (Siemens AG)


    No partial-version exception is documented. If the firmware is below V7.26.0310, it is considered affected across the entire vulnerability set.


    ## Mitigations


    Primary remediation:


  • Update all SIDIS Secured SmartPlug devices to firmware version V7.26.0310 or later immediately. This is the only vendor-confirmed fix; there are no documented workarounds for the cryptographic vulnerabilities.

    • Compensating controls while patching:


  • Segment SmartPlug devices onto isolated VLANs with no direct internet exposure. These devices have no business being reachable from untrusted networks.
  • Restrict Wi-Fi association to known MAC addresses and use WPA3 with properly updated supplicant stacks — the SAE and EAP-pwd side-channel issues (CVE-2022-23303, CVE-2022-23304) require wireless adjacency or local access to exploit.
  • Audit device inventories. Facilities running SIDIS SmartPlugs in energy monitoring roles may have deployed and forgotten them; pull an accurate asset list before declaring exposure minimal.
  • Monitor firmware update telemetry centrally. In OT/ICS environments, firmware patches often require maintenance windows and physical access — schedule those now rather than after an incident.
  • For CVE-2022-37660 (PKEX key reuse), any prior PKEX-based key bootstrapping with an untrusted party should be considered potentially compromised. Re-bootstrap with fresh keys post-patch.

    • ## References


  • [ICS-CERT / CISA Advisory — Siemens SIDIS Secured SmartPlug](https://www.cisa.gov/news-events/ics-advisories)
  • [Siemens ProductCERT Security Advisories](https://cert.siemens.com/pkistore/html/index.html)
  • [CVE-2022-23303 Details](https://nvd.nist.gov/vuln/detail/CVE-2022-23303)
  • [CVE-2022-23304 Details](https://nvd.nist.gov/vuln/detail/CVE-2022-23304)
  • [CVE-2022-37660 Details](https://nvd.nist.gov/vuln/detail/CVE-2022-37660)
  • [CVE-2022-48174 Details](https://nvd.nist.gov/vuln/detail/CVE-2022-48174)
  • [hostapd / wpa_supplicant Project](https://w1.fi/wpa_supplicant/)

    • ---


    ## HackWire Analysis


    The most uncomfortable detail in this advisory is the publication date gap. CVE-2022-23303 and CVE-2022-23304 are three years old. The BusyBox overflow (CVE-2022-48174) dates to 2022 as well. These weren't zero-days when Siemens shipped this patch — they were known, catalogued vulnerabilities in widely-used open-source components that sat unaddressed in shipping firmware for the better part of a hardware lifecycle.


    This is the embedded OT firmware problem in concrete form. Siemens is a mature, well-resourced vendor with an active ProductCERT team. If they're shipping a patch in mid-2026 for vulnerabilities disclosed in 2022, imagine the state of firmware from vendors without a dedicated security response function.


    The PKEX flaw (CVE-2022-37660) deserves particular attention from defenders because it's not a crash-and-exploit scenario — it's a passive observation attack. An adversary who previously bootstrapped a public key relationship with a target device can silently recover the ephemeral key from subsequent exchanges without transmitting anything. This is the kind of vulnerability that could have been quietly exploited for months before anyone noticed, because there's no anomalous traffic to alert on.


    For organizations running industrial energy management infrastructure: the SmartPlug's role as a load-monitoring device makes it a useful lateral movement pivot. It has network access, runs a full embedded Linux stack, and is typically managed by facilities teams rather than security teams. That combination — network-connected, Linux-based, overlooked in patch cycles — is exactly the profile threat actors target for persistent footholds in OT environments. Patch it, segment it, and add it to your OT asset inventory if it isn't already there.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)