What is the CVSS score of CVE-2026-25573?

CVE-2026-25573 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sicam Siapp Sdk are affected by CVE-2026-25573?

Organizations using SICAM SIAPP SDK versions prior to V2.1.7 face a command injection vulnerability that could allow attackers to execute arbitrary code on affected systems.

How to fix or mitigate CVE-2026-25573?

Within 24 hours: Inventory all systems running SICAM SIAPP SDK and identify which versions are deployed; isolate or restrict network access to affected systems. Within 7 days: Implement network segmentation to limit lateral movement from compromised systems; disable SDK features if operationally feasible; establish monitoring for suspicious command execution patterns. Within 30 days: Contact Siemens for patch availability and timeline; develop and test upgrade plan to V2.1.7 or later; deploy patches immediately upon release.

Sicam Siapp Sdk CVE-2026-25573

HIGH

External Control of File Name or Path (CWE-73)

2026-03-10 productcert@siemens.com

Command Injection Sicam Siapp Sdk

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application builds shell commands with caller-provided strings and executes them. An attacker could influence the executed command, potentially resulting in command injection and full system compromise.

AnalysisAI

Command injection in SICAM SIAPP SDK versions prior to 2.1.7 allows unauthenticated local attackers to manipulate shell command construction and achieve arbitrary code execution with full system privileges. The vulnerability stems from insufficient input validation when building and executing system commands with user-supplied data. No patch is currently available, leaving all affected versions vulnerable to complete system compromise.

Technical ContextAI

Affects Sicam Siapp Sdk. A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application builds shell commands with caller-provided strings and executes them. An attacker could influence the executed command, potentially resulting in command injection and full system compromise.