CVE-2025-2884: Siemens SIMATIC Cn 4100

Medium severity, CVSS 6.6. EPSS: 0.3% chance of exploitation in the next 30 days.

TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0

Affected products

• Siemens SIMATIC Cn 4100: any version
• Siemens SIMATIC Field Pg m5: any version
• Siemens SIMATIC Field Pg m6: before V26.01.14 (fixed in V26.01.14)
• Siemens SIMATIC IPC227E: any version
• Siemens SIMATIC IPC277E: any version
• Siemens SIMATIC IPC427E: before V21.01.20 (fixed in V21.01.20)
• Siemens SIMATIC IPC477E: before V21.01.20 (fixed in V21.01.20)
• Siemens SIMATIC IPC477E Pro: before V21.01.20 (fixed in V21.01.20)
• Siemens SIMATIC IPC627E: any version
• Siemens SIMATIC IPC647E: any version
• Siemens SIMATIC IPC677E: any version
• Siemens SIMATIC IPC847E: any version
• Siemens SIMATIC Ipc Bx-32a: before V29.01.09 (fixed in V29.01.09)
• Siemens SIMATIC Ipc Bx-39a: before V29.01.09 (fixed in V29.01.09)
• Siemens SIMATIC Ipc Bx-56a: before V32.01.09 (fixed in V32.01.09)
• Siemens SIMATIC Ipc Bx-59a: before V32.01.09 (fixed in V32.01.09)
• Siemens SIMATIC Ipc Md-57a: before V30.01.10 (fixed in V30.01.10)
• Siemens SIMATIC Ipc Px-32a: before V29.01.09 (fixed in V29.01.09)
• Siemens SIMATIC Ipc Px-39a: before V29.01.09 (fixed in V29.01.09)
• Siemens SIMATIC Ipc Px-39a Pro: before V29.01.09 (fixed in V29.01.09)
• Siemens SIMATIC Ipc Rw-528a: before V34.01.02 (fixed in V34.01.02)
• Siemens SIMATIC Ipc Rw-548a: before V34.01.02 (fixed in V34.01.02)
• Siemens SIMATIC ITP1000: any version
• Siemens Siplus IPC427E: before V21.01.20 (fixed in V21.01.20)
• Trusted Computing Group TPM2.0: before 1.83 (fixed in 1.83)

Published 2025-06-10. Last modified 2026-08-11.