{"document":{"category":"csaf_security_advisory","csaf_version":"2.0","title":"Fixed outdated OpenSSL in NT-200 firmware","publisher":{"category":"vendor","name":"Review Workshop","namespace":"https://www.vandorisk.com/advisories/review-workshop-qa","issuing_authority":"The publisher chose its own name and web address on Vandorisk; Vandorisk has not verified its identity."},"tracking":{"id":"2026-001-openssl","status":"final","version":"1","initial_release_date":"2026-09-29T00:18:57.769Z","current_release_date":"2026-09-29T00:18:57.769Z","revision_history":[{"date":"2026-09-29T00:18:57.769Z","number":"1","summary":"Initial public release."}]},"distribution":{"tlp":{"label":"WHITE"}},"notes":[{"category":"summary","title":"Summary","text":"OpenSSL high findings in the NT-200 firmware SBOM are addressed in 1.0.2. Users should update via signed OTA."},{"category":"details","title":"Details","text":"A screen of the NT-200 SBOM found high OpenSSL advisories.\n\nUpdate to 1.0.2 via signed OTA."}]},"product_tree":{"branches":[{"category":"product_name","name":"Review Thermostat NT-200","branches":[{"category":"product_version_range","name":"1.0.0 – 1.0.1","product":{"product_id":"CSAFPID-0001","name":"Review Thermostat NT-200 1.0.0 – 1.0.1"}},{"category":"product_version_range","name":"1.0.2","product":{"product_id":"CSAFPID-0002","name":"Review Thermostat NT-200 1.0.2"}}]}]},"vulnerabilities":[{"cve":"CVE-2026-41678","notes":[{"category":"description","title":"Summary","text":"OpenSSL high findings in the NT-200 firmware SBOM are addressed in 1.0.2. Users should update via signed OTA."}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]}}]}