EUVD-2026-42594
GHSA-j26p-j946-5hv2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Firmware update requires local, privileged access (AV:L/PR:H) with no user interaction, and yields full device takeover, so C/I/A are all High.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.
AnalysisAI
Malicious firmware installation is possible on Siemens CPCI85 Central Processing/Communication firmware (versions before V26.20) and the SICORE Base System (before V26.20.0) because the firmware update mechanism fails to properly validate signatures. An attacker with high privileges and local access can push crafted, tampered firmware to achieve persistent code execution and full device compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Technical ContextAI
The affected components are Siemens power-automation firmware: CPCI85 is the central processing/communication module firmware used in SICAM-family telecontrol/substation devices, and SICORE Base System is the associated base runtime (CPE cpe:2.3:a:siemens:cpci85_central_processing/communication and cpe:2.3:a:siemens:sicore_base_system). The root cause is a broken signature-validation step in the firmware update path, meaning the cryptographic authenticity/integrity checks that should gate which firmware the device accepts are ineffective or bypassable. The advisory tags this as CWE-489; note that CWE-489 (Active/Leftover Debug Code) does not cleanly match a signature-validation failure (which is closer to CWE-347, Improper Verification of Cryptographic Signature) - the description, not the CWE label, is the reliable indicator of the actual defect.
RemediationAI
Vendor-released patch: update CPCI85 Central Processing/Communication to V26.20 or later and the SICORE Base System to V26.20.0 or later, per Siemens advisory SSA-229470 (https://cert-portal.siemens.com/productcert/html/ssa-229470.html). Because exploitation requires local, privileged access to the firmware update function, the primary compensating control until patching is to restrict and monitor who can perform firmware updates: place devices in protected control-network cells behind firewalls, disable or tightly restrict remote/engineering access to the update interface, and require physical and administrative access controls for maintenance - the trade-off is added operational friction for legitimate firmware updates. Additionally, verify firmware provenance and integrity before and after any update and log update events to detect unauthorized firmware changes.
Out-of-bounds write vulnerabilities in Siemens CPCI85 Central Processing/Communication and SICORE Base system (versions
Remote denial-of-service in Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base (versions below V26.10)
Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.
Denial of service in Siemens CPCI85 Central Processing/Communication firmware and SICORE Base System (all versions befor
Insecure default OPC UA configuration in Siemens CPCI85 Central Processing/Communication and SICORE Base System exposes
Same weakness CWE-489 – Active Debug Code
View allShare
External POC / Exploit Code
Leaving vuln.today