CVE-2020-36478

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-23 · updated 2026-06-17
Weakness: CWE-295

Description

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.

Affected products

mbedtls: before 2.7.18; from 2.8.0 before 2.16.9; from 2.17.0 before 2.25.0 — fixed in 2.16.9, 2.25.0, 2.7.18
Debian Linux: 9.0, 10.0
Siemens Logo! Cmr2020 Firmware: before 2.2 — fixed in 2.2
Siemens Logo! Cmr2040 Firmware: before 2.2 — fixed in 2.2
Siemens Simatic Rtu3000C Firmware: all versions
Siemens Simatic Rtu3030C Firmware: all versions
Siemens Simatic Rtu3031C Firmware: all versions
Siemens Simatic Rtu3041C Firmware: all versions

How to fix

Upgrade to a fixed version: mbedtls 2.16.9, 2.25.0, 2.7.18; Siemens Logo! Cmr2020 Firmware 2.2; Siemens Logo! Cmr2040 Firmware 2.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-36478 or the next vulnerability affects your stack