Which versions of Siemens CPCI85 are affected by CVE-2026-54801?

Siemens CPCI85 and SICORE Base System (versions prior to 26.20.0) contain a privilege escalation vulnerability enabling authenticated users to obtain administrator-level access through weak…

How to fix or mitigate CVE-2026-54801?

24 hours: Audit and document all Siemens CPCI85 and SICORE Base System installations and current versions; implement firewall rules restricting web API access to authorized network segments only. 7 days: Enable detailed logging of all administrative account modifications; review recent administrative changes for anomalies; audit current user access rights. 30 days: Obtain patch availability and timeline from Siemens; prepare patch deployment procedures for version 26.20.0 or later; consider extended network isolation if patch remains unavailable.

Siemens CPCI85 CVE-2026-54801

Q: What is the CVSS score of CVE-2026-54801?

CVE-2026-54801 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42596 HIGH

Unverified Password Change (CWE-620)

2026-07-09 siemens

GHSA-79vc-rc2r-m8rf

Authentication Bypass Siemens Cpci85 Central Processing Communication Sicore Base System

8.6

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable web API (AV:N/AC:L) but requires an existing high-privilege authenticated session (PR:H); privilege abuse yields full C/I/A impact on the same system (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 09, 2026 - 15:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 09, 2026 - 15:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 09, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jul 09, 2026 - 15:22 NVD

7.2 (HIGH) 8.6 (HIGH)

Analysis Generated

Jul 09, 2026 - 14:47 vuln.today

DescriptionCVE.org

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.

AnalysisAI

Privilege escalation in Siemens CPCI85 Central Processing/Communication and SICORE Base System (all versions before V26.20 / V26.20.0) lets an already-authenticated attacker abuse insufficient validation of authentication credentials when modifying administrative accounts through the web API. By exploiting this weak credential re-verification (CWE-620), an attacker with existing access can bypass security controls and obtain unauthorized elevated privileges over the device. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected firmware, CPCI85 Central Processing/Communication and the SICORE Base System, provides the processing and communication substrate used in Siemens energy-automation and substation equipment, exposing a web-based management API for administration. The root cause is classified as CWE-620 (Unverified Password Change): the administrative account-modification flow does not adequately re-validate the requester's existing authentication credentials before applying changes, so a sensitive operation (altering an admin account) proceeds without the credential proof that should gate it. CPE data scopes the flaw to cpe:2.3:a:siemens:cpci85_central_processing/communication and cpe:2.3:a:siemens:sicore_base_system across all versions below the fixed release.

RemediationAI

Upgrade CPCI85 Central Processing/Communication to V26.20 or later and the SICORE Base System to V26.20.0 or later, per Siemens ProductCERT advisory SSA-229470 (https://cert-portal.siemens.com/productcert/html/ssa-229470.html). Because the flaw is reachable over the web API, until patching is complete restrict network access to the device's management/web API to a trusted engineering network or management VLAN and place it behind a firewall (consistent with Siemens' standard operational-technology hardening guidance), which limits reachability but does not stop an attacker who already has privileged access. Additionally, tightly limit and monitor the set of accounts holding high privileges and audit administrative account-modification activity, since exploitation requires an authenticated high-privilege session; the trade-off is added operational overhead but reduced insider/lateral-movement exposure.