EUVD-2026-42593
GHSA-jw99-297g-63f5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable HTTP endpoint with low attack complexity but requires an authenticated session (PR:L); impact is limited to availability via web-process crash, so C:N/I:N/A:H.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt the system by crashing the web process causing denial of service conditions.
AnalysisAI
Denial of service in Siemens CPCI85 Central Processing/Communication firmware and SICORE Base System (all versions before V26.20 / V26.20.0) allows an authenticated attacker to crash the device's web process via a leftover debugging interface exposed on HTTP endpoints. The flaw stems from active debug code shipped in production firmware and affects only availability, not data confidentiality or integrity. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The affected components are Siemens firmware/software modules used in SICAM-class energy-automation and communication equipment: the CPCI85 Central Processing/Communication module and the SICORE Base System (per CPE cpe:2.3:a:siemens:cpci85_central_processing/communication and cpe:2.3:a:siemens:sicore_base_system). The root cause maps to CWE-489 (Active Debug Code): a debugging interface intended for development was left reachable through the product's HTTP endpoints in shipped firmware. Because the debug interface is exposed to the network-facing web service, requests to it can drive the web process into an unstable state and terminate it, interrupting the management/communication service the device provides.
RemediationAI
Vendor-released patch: update CPCI85 Central Processing/Communication to V26.20 or later and SICORE Base System to V26.20.0 or later, as directed in Siemens advisory SSA-229470 (https://cert-portal.siemens.com/productcert/html/ssa-229470.html). Where immediate patching is not feasible, apply Siemens' standard OT compensating controls: restrict network access to the device's HTTP management endpoints so only trusted engineering hosts can reach them (network segmentation / firewall ACLs), and place the devices behind a protection cell per Siemens' operational-security guidance - the trade-off is added management overhead and the need to whitelist legitimate management traffic. Because exploitation requires authentication, also tighten and rotate management credentials and limit the set of accounts that can reach the web interface; the side effect is reduced convenience for operators who previously shared broad access.
Out-of-bounds write vulnerabilities in Siemens CPCI85 Central Processing/Communication and SICORE Base system (versions
Remote denial-of-service in Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base (versions below V26.10)
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.
Malicious firmware installation is possible on Siemens CPCI85 Central Processing/Communication firmware (versions before
Insecure default OPC UA configuration in Siemens CPCI85 Central Processing/Communication and SICORE Base System exposes
Same weakness CWE-489 – Active Debug Code
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today