What is the CVSS score of CVE-2026-25572?

CVE-2026-25572 has a CVSS 3.1 base score of 5.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sicam Siapp Sdk are affected by CVE-2026-25572?

Organizations using variables should be aware of moderate risk from CVE-2026-25572 rated CVSS 5.1. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-25572?

Within 30 days: Identify affected systems running variables and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Sicam Siapp Sdk CVE-2026-25572

MEDIUM

Improper Handling of Length Parameter Inconsistency (CWE-130)

2026-03-10 productcert@siemens.com

Denial Of Service Sicam Siapp Sdk

5.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK server component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.

AnalysisAI

Stack overflow in SICAM SIAPP SDK versions prior to 2.1.7 allows local attackers to crash the server component by submitting oversized input that bypasses length validation, resulting in denial of service. The vulnerability stems from missing input length checks on certain variables processed by the SDK server. No patch is currently available for affected installations.

Technical ContextAI

has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK server component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.