PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-47629 Siemens CVE debrief

CVE-2022-47629 is a critical integer overflow vulnerability in Libksba versions prior to 1.6.3, specifically affecting the CRL (Certificate Revocation List) signature parser. The vulnerability was published on April 9, 2024, and most recently modified on May 13, 2025. Siemens RUGGEDCOM APE1808 devices are affected through this upstream dependency. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical), indicating network-exploitable, low-complexity attacks that can result in complete confidentiality, integrity, and availability compromise without requiring authentication or user interaction. CISA's advisory ICSA-24-102-04, first published April 9, 2024, tracks this vulnerability among multiple upstream components affecting the RUGGEDCOM APE1808 platform. Siemens has issued security advisory SSA-455250 addressing this issue. A vendor fix is available requiring upgrade to Palo Alto Networks Virtual NGFW V11.1.2-h3; customers must contact Siemens customer support to obtain patch and update information. The advisory has undergone seven revisions, with the most recent update on May 13, 2025 adding CVE-2025-0127 to the tracked vulnerabilities.

Vendor
Siemens
Product
RUGGEDCOM APE1808
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-13
Original CVE updated
2024-02-13
Advisory published
2024-02-13
Advisory updated
2024-02-13

Who should care

Organizations operating Siemens RUGGEDCOM APE1808 industrial networking devices, particularly those deployed in critical infrastructure environments processing X.509 certificates and CRLs. Security teams responsible for OT/ICS asset management, certificate authority infrastructure operators, and compliance officers tracking CISA ICS advisories for regulated industrial sectors.

Technical summary

Integer overflow in Libksba CRL signature parser (CVE-2022-47629) enables potential remote code execution or denial of service through crafted certificate revocation list data. Affects Siemens RUGGEDCOM APE1808 via upstream dependency chain. Fixed in Libksba 1.6.3; Siemens remediation requires Palo Alto NGFW V11.1.2-h3 upgrade obtained through customer support.

Defensive priority

critical

Recommended defensive actions

  • Contact Siemens customer support to obtain patch and update information for upgrading Palo Alto Networks Virtual NGFW to version V11.1.2-h3 on affected RUGGEDCOM APE1808 devices
  • Review Siemens security advisory SSA-455250 for detailed technical guidance and additional affected product information
  • Apply defense-in-depth strategies for industrial control systems as recommended by CISA, including network segmentation and access controls
  • Monitor CISA ICS advisories for future updates to ICSA-24-102-04, which has been revised seven times since initial publication
  • Verify Libksba version on any systems processing CRL signatures and upgrade to version 1.6.3 or later where applicable

Evidence notes

Vulnerability description sourced from CISA CSAF advisory ICSA-24-102-04. Affected product (Siemens RUGGEDCOM APE1808) and vendor confirmed via CSAF product tree with high confidence. Remediation details extracted from CSAF remediations section. CVSS vector and score from source item metadata. Timeline derived from CSAF revision history and CVE published/modified dates.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-47629 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-47629

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-47629 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-47629

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-455250.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-455250.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.