CVE-2026-28388 Cert Portal CVE debrief

Who should care

Administrators and integrators running Siemens SIMATIC CN 4100 version <5.0, especially where X.509 certificate verification uses CRL processing with X509_V_FLAG_USE_DELTAS or accepts externally supplied CRLs.

Technical summary

According to the Siemens/CISA advisory, delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. An attacker who can supply a malformed CRL can cause a NULL pointer dereference when the verification context enables X509_V_FLAG_USE_DELTAS and the certificate or base CRL triggers freshestCRL/delta CRL handling. The documented impact is a crash and denial of service; the source states it cannot be escalated to code execution or memory disclosure.

Defensive priority

Medium. The issue is limited to availability impact and requires specific verification settings plus attacker-controlled malformed CRL input, but it can still crash affected applications.

Recommended defensive actions

• Update Siemens SIMATIC CN 4100 to V5.0 or later, per vendor remediation guidance.
• Review any certificate-validation paths that enable delta CRL processing and confirm whether X509_V_FLAG_USE_DELTAS is necessary.
• Treat external CRLs as untrusted input and validate that CRL Number / delta CRL fields are present before processing.
• If operationally feasible, reduce or remove reliance on delta CRL processing in affected environments.
• Monitor Siemens ProductCERT and CISA advisory guidance for deployment-specific mitigation updates.

Evidence notes

The source advisory says the issue occurs when a delta CRL with a Delta CRL Indicator extension is processed and the required CRL Number extension is missing, leading to a NULL pointer dereference and denial of service. It further states exploitation requires X509_V_FLAG_USE_DELTAS, freshestCRL/EXFLAG_FRESHEST conditions, and attacker-supplied malformed CRL input. The advisory lists remediation as updating to V5.0 or later and notes that the FIPS modules in 3.6, 3.5, 3.4, 3.3, and 3.0 are not affected because the code is outside the module boundary.

Official resources