CVE-2022-48174: Critical – Siemens SIDIS Secured SmartPlug

CWE Weakness Definitions

CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

◆ SAGE Intelligence — CITED Relevance Research Team

A stack overflow vulnerability exists in ash.c:6030 in busybox versions prior to 1.35, which could lead to arbitrary code execution in the context of Internet of Vehicles. This vulnerability has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability.

BSID: BS-2023-GLOBAL-337309-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2022-48174?

A stack overflow vulnerability exists in ash.c:6030 in busybox versions prior to 1.35, which could lead to arbitrary code execution in the context of Internet of Vehicles. This vulnerability has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability.

What is the CVSS score for CVE-2022-48174?

CVE-2022-48174 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 3.1%.

Is CVE-2022-48174 actively exploited?

No confirmed active exploitation of CVE-2022-48174 as of 2026-07-22.

How do I remediate CVE-2022-48174?

Priority: HIGH. Advisory: https://bugs.busybox.net/show_bug.cgi?id=15216 PSIRT: [email protected]

What systems are affected by CVE-2022-48174?

CVE-2022-48174 affects: Busybox, Debian, Fujitsu-Siemens, Siemens.

What NERC-CIP standard applies to CVE-2022-48174?

NERC CIP CIP-007 CIP-007-R2: This CVE violates CIP-007-R2 as it allows unauthorized access to control system devices, potentially compromising the security of the electronic security perimeter.

What IEC 62443 requirement maps to CVE-2022-48174?

IEC 62443 SR 7.6: This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited to execute arbitrary code, which could compromise the security of the industrial control system and affect its operational integrity.

Vulnerability Details

CVE ID	`CVE-2022-48174`
BSID	`BS-2023-GLOBAL-337309-C` BreachSpider Global ID
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
Published	2026-07-21
Last Modified	2026-07-21
ICS Relevance	70%
Weakness (CWE)	Out-of-Bounds Write
Verticals	ICS-OT
Source	NVD

Official Description

View CSAF Summary SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version. The following versions of Siemens SIDIS Secured SmartPlug are affected: SIDIS Secured SmartPlug vers:intdot/<7.26.0310 CVSS Vendor Equipment Vulnerabilities v3 9.8 Siemens Siemens SIDIS Secured SmartPlug Imp

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability can be exploited remotely without authentication, requiring low skill level. An attacker can trigger the stack overflow by crafting specific input to the affected function, leading to arbitrary code execution. This poses significant risks in IoT environments, particularly in vehicles where safety and reliability are paramount.

Exploitation Likelihood: MEDIUM

Affected Products

Vendor	Product	Fixed Version
Busybox	Busybox	—
Debian	Debian Linux	—
Fujitsu-Siemens	—	—
Siemens	—	—

Remediation

View Vendor Advisory →

Remediation Priority: HIGH

Vendor PSIRT: [email protected]

Threat Intelligence

● Threat Intelligence Validated: July 2026 | Threat Age: 0 Days

CISA KEV	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

● Virtual Patch — CITED Relevance SAGE Engine MEDIUM CONFIDENCE

Implement strict input validation and length checks for commands processed by the affected Busybox version. Consider deploying a web application firewall (WAF) to filter out suspicious traffic.

No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.

NERC CIP: CIP-007 CIP-007-R2
This CVE violates CIP-007-R2 as it allows unauthorized access to control system devices, potentially compromising the security of the electronic security perimeter.

IEC 62443: SR 7.6
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited to execute arbitrary code, which could compromise the security of the industrial control system and affect its operational integrity.

Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.

SAGE Enrichment Record — provenance & audit hash

Model	`Qwen/Qwen2.5-72B-Instruct-AWQ`
Confidence	HIGH
Enriched At	2026-05-24
SHA-512 Audit Hash	`824a06293a19dc8d775fcbafb899ed66f60787b473c318bd2eda7e6410f7a954d3ac5699847a036443865b5b24b597426cb314b8c5fb5a5a91678c4589c5a640`

Related CVEs affecting Busybox

CVE-2021-42377 9.8 An attacker-controlled pointer free in Busybox's hush applet leads to denial ... CVE-2018-1000517 9.8 BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e0... CVE-2016-2148 9.8 Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25... CVE-2017-16544 8.8 In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the ... CVE-2022-28391 8.8 BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if n...

View all Busybox CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →