CVE-2025-2884 (GCVE-0-2025-2884)

Vulnerability from cvelistv5 – Published: 2025-06-10 17:29 – Updated: 2026-04-14 08:58
VLAI
Title
Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
Summary
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
Severity
6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Trusted Computing Group TPM2.0 Affected: 0 , < 1.83 (custom)
Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC Field PG M5 Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC Field PG M6 Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC IPC BX-32A Affected: 0 , < V29.01.09 (custom)
Create a notification for this product.
Siemens SIMATIC IPC BX-39A Affected: 0 , < V29.01.09 (custom)
Create a notification for this product.
Siemens SIMATIC IPC BX-56A Affected: 0 , < V32.01.09 (custom)
Create a notification for this product.
Siemens SIMATIC IPC BX-59A Affected: 0 , < V32.01.09 (custom)
Create a notification for this product.
Siemens SIMATIC IPC MD-57A Affected: 0 , < V30.01.10 (custom)
Create a notification for this product.
Siemens SIMATIC IPC PX-32A Affected: 0 , < V29.01.09 (custom)
Create a notification for this product.
Siemens SIMATIC IPC PX-39A Affected: 0 , < V29.01.09 (custom)
Create a notification for this product.
Siemens SIMATIC IPC PX-39A PRO Affected: 0 , < V29.01.09 (custom)
Create a notification for this product.
Siemens SIMATIC IPC RW-528A Affected: 0 , < V34.01.02 (custom)
Create a notification for this product.
Siemens SIMATIC IPC RW-548A Affected: 0 , < V34.01.02 (custom)
Create a notification for this product.
Siemens SIMATIC IPC227E Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC IPC277E Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC IPC427E Affected: 0 , < V21.01.20 (custom)
Create a notification for this product.
Siemens SIMATIC IPC477E Affected: 0 , < V21.01.20 (custom)
Create a notification for this product.
Siemens SIMATIC IPC477E PRO Affected: 0 , < V21.01.20 (custom)
Create a notification for this product.
Siemens SIMATIC IPC627E Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC IPC647E Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC IPC677E Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC IPC847E Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIMATIC ITP1000 Affected: 0 , < * (custom)
Create a notification for this product.
Siemens SIPLUS IPC427E Affected: 0 , < V21.01.20 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-06-10T19:02:29.811Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01209.html"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/282450"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-2884",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-13T01:41:10.489446Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-13T01:46:13.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC Field PG M5",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC Field PG M6",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC BX-32A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V29.01.09",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC BX-39A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V29.01.09",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC BX-56A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V32.01.09",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC BX-59A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V32.01.09",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC MD-57A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V30.01.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC PX-32A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V29.01.09",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC PX-39A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V29.01.09",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC PX-39A PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V29.01.09",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC RW-528A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V34.01.02",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC RW-548A",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V34.01.02",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC227E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC277E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC427E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V21.01.20",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC477E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V21.01.20",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC477E PRO",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V21.01.20",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC627E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC647E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC677E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC IPC847E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC ITP1000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS IPC427E",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V21.01.20",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T08:58:06.200Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-628843.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TPM2.0",
          "vendor": "Trusted Computing Group",
          "versions": [
            {
              "lessThan": "1.83",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TCG TPM2.0 Reference implementation\u0027s CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key\u0027s algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "id": "CVE-2025-2884",
              "selections": [
                {
                  "name": "Exploitation",
                  "namespace": "ssvc",
                  "values": [
                    "none"
                  ],
                  "version": "1.0.0"
                },
                {
                  "name": "Automatable",
                  "namespace": "ssvc",
                  "values": [
                    "no"
                  ],
                  "version": "2.0.0"
                },
                {
                  "name": "Technical Impact",
                  "namespace": "ssvc",
                  "values": [
                    "partial"
                  ],
                  "version": "1.0.0"
                },
                {
                  "name": "Mission \u0026 Well-being",
                  "namespace": "ssvc",
                  "values": [
                    "medium"
                  ],
                  "version": "1.0.0"
                }
              ],
              "timestamp": "2025-06-13T17:22:30.584Z"
            },
            "type": "ssvcV1_0_1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-13T18:22:21.856Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://trustedcomputinggroup.org/about/security/"
        },
        {
          "name": "TPM2.0 Errata",
          "url": "https://trustedcomputinggroup.org/wp-content/uploads/TPM2.0-Library-Spec-v1.83-Errata_v1_pub.pdf"
        },
        {
          "name": "Vendor Advisory",
          "url": "https://trustedcomputinggroup.org/wp-content/uploads/VRT0009-Advisory-FINAL.pdf"
        },
        {
          "name": "Vendor Patch",
          "url": "https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1"
        },
        {
          "name": "Related CVE",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-49133"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation",
      "x_generator": {
        "engine": "VINCE 3.0.20",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-2884"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2025-2884",
    "datePublished": "2025-06-10T17:29:19.463Z",
    "dateReserved": "2025-03-27T21:01:41.908Z",
    "dateUpdated": "2026-04-14T08:58:06.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-2884",
      "date": "2026-06-04",
      "epss": "0.00078",
      "percentile": "0.23203"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-2884\",\"sourceIdentifier\":\"cret@cert.org\",\"published\":\"2025-06-10T18:15:30.617\",\"lastModified\":\"2026-04-14T10:16:26.457\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"TCG TPM2.0 Reference implementation\u0027s CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key\u0027s algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n auxiliar CryptHmacSign de la implementaci\u00f3n de referencia TCG TPM2.0 es vulnerable a lecturas fuera de los l\u00edmites debido a la falta de validaci\u00f3n del esquema de firma con el algoritmo de la clave de firma. Consulte la errata 1.83 del est\u00e1ndar TCG TPM2.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1\",\"source\":\"cret@cert.org\"},{\"url\":\"https://trustedcomputinggroup.org/about/security/\",\"source\":\"cret@cert.org\"},{\"url\":\"https://trustedcomputinggroup.org/wp-content/uploads/TPM2.0-Library-Spec-v1.83-Errata_v1_pub.pdf\",\"source\":\"cret@cert.org\"},{\"url\":\"https://trustedcomputinggroup.org/wp-content/uploads/VRT0009-Advisory-FINAL.pdf\",\"source\":\"cret@cert.org\"},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2025-49133\",\"source\":\"cret@cert.org\"},{\"url\":\"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01209.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.kb.cert.org/vuls/id/282450\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-628843.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01209.html\"}, {\"url\": \"https://www.kb.cert.org/vuls/id/282450\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-06-10T19:02:29.811Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC CN 4100\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC Field PG M5\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC Field PG M6\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC BX-32A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V29.01.09\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC BX-39A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V29.01.09\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC BX-56A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V32.01.09\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC BX-59A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V32.01.09\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC MD-57A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V30.01.10\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC PX-32A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V29.01.09\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC PX-39A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V29.01.09\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC PX-39A PRO\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V29.01.09\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC RW-528A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V34.01.02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC RW-548A\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V34.01.02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC227E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC277E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC427E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V21.01.20\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC477E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V21.01.20\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC477E PRO\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V21.01.20\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC627E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC647E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC677E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC IPC847E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC ITP1000\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS IPC427E\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V21.01.20\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-628843.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-04-14T08:58:06.200Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.6, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-2884\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-13T01:41:10.489446Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-11T15:04:54.186Z\"}}], \"cna\": {\"title\": \"Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation\", \"source\": {\"discovery\": \"INTERNAL\"}, \"metrics\": [{\"other\": {\"type\": \"ssvcV1_0_1\", \"content\": {\"id\": \"CVE-2025-2884\", \"timestamp\": \"2025-06-13T17:22:30.584Z\", \"selections\": [{\"name\": \"Exploitation\", \"values\": [\"none\"], \"version\": \"1.0.0\", \"namespace\": \"ssvc\"}, {\"name\": \"Automatable\", \"values\": [\"no\"], \"version\": \"2.0.0\", \"namespace\": \"ssvc\"}, {\"name\": \"Technical Impact\", \"values\": [\"partial\"], \"version\": \"1.0.0\", \"namespace\": \"ssvc\"}, {\"name\": \"Mission \u0026 Well-being\", \"values\": [\"medium\"], \"version\": \"1.0.0\", \"namespace\": \"ssvc\"}]}}}], \"affected\": [{\"vendor\": \"Trusted Computing Group\", \"product\": \"TPM2.0\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.83\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://trustedcomputinggroup.org/about/security/\"}, {\"url\": \"https://trustedcomputinggroup.org/wp-content/uploads/TPM2.0-Library-Spec-v1.83-Errata_v1_pub.pdf\", \"name\": \"TPM2.0 Errata\"}, {\"url\": \"https://trustedcomputinggroup.org/wp-content/uploads/VRT0009-Advisory-FINAL.pdf\", \"name\": \"Vendor Advisory\"}, {\"url\": \"https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1\", \"name\": \"Vendor Patch\"}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2025-49133\", \"name\": \"Related CVE\"}], \"x_generator\": {\"env\": \"prod\", \"engine\": \"VINCE 3.0.20\", \"origin\": \"https://cveawg.mitre.org/api/cve/CVE-2025-2884\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"TCG TPM2.0 Reference implementation\u0027s CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key\u0027s algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"37e5125f-f79b-445b-8fad-9564f167944b\", \"shortName\": \"certcc\", \"dateUpdated\": \"2025-06-13T18:22:21.856Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-2884\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-14T08:58:06.200Z\", \"dateReserved\": \"2025-03-27T21:01:41.908Z\", \"assignerOrgId\": \"37e5125f-f79b-445b-8fad-9564f167944b\", \"datePublished\": \"2025-06-10T17:29:19.463Z\", \"assignerShortName\": \"certcc\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.