CPCI85 / SICORE EUVD-2026-42595

Q: What is the CVSS score of EUVD-2026-42595?

EUVD-2026-42595 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

Q: Which versions of CPCI85 / SICORE are affected by EUVD-2026-42595?

Insecure default OPC UA configuration in Siemens CPCI85 Central Processing/Communication and SICORE Base System exposes industrial control system functions to unauthenticated network attackers.

| CVE-2026-54800 MEDIUM

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-07-09 siemens

GHSA-6556-7hqh-p69q

Authentication Bypass Cpci85 Central Processing Communication Sicore Base System

6.3

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Network reachable with no auth required (PR:N); AC:H for OT protocol knowledge; I:H because control over critical system functions implies meaningful integrity impact beyond the vendor's conservative I:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 09, 2026 - 15:22 NVD

4.8 (MEDIUM) 6.3 (MEDIUM)

Analysis Generated

Jul 09, 2026 - 14:54 vuln.today

DescriptionCVE.org

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.

AnalysisAI

Insecure default OPC UA configuration in Siemens CPCI85 Central Processing/Communication and SICORE Base System exposes industrial control system functions to unauthenticated network attackers. Both products ship with all OPC UA security mechanisms disabled, meaning any attacker who can reach the OPC UA endpoint over the network can interact with the system without authentication or encryption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the affected products operate in OT/ICS environments where unauthorized control access carries disproportionate operational and safety risk relative to the moderate CVSS score.

Technical ContextAI

OPC UA (OPC Unified Architecture) is an industrial interoperability protocol widely used in SCADA, DCS, and ICS environments for machine-to-machine communication. It includes built-in security modes - None, Sign, and Sign&Encrypt - that govern session authentication and message integrity. CWE-1188 (Initialization of a Resource with an Insecure Default Value) captures the root cause: the software ships configured to use OPC UA Security Mode None, which disables authentication, signing, and encryption entirely. The affected products per CPE are cpe:2.3:a:siemens:cpci85_central_processing/communication:*:*:*:*:*:*:*:* (all versions prior to V26.20) and cpe:2.3:a:siemens:sicore_base_system:*:*:*:*:*:*:*:* (all versions prior to V26.20.0). These are embedded OT components - the CPCI85 is a central processing and communication module used in Siemens protection and automation systems, and SICORE is its underlying base firmware - meaning the OPC UA surface is typically exposed on isolated OT networks rather than public internet.

RemediationAI

Upgrade CPCI85 Central Processing/Communication to V26.20 or later and SICORE Base System to V26.20.0 or later, as documented in Siemens ProductCERT advisory SSA-229470 at https://cert-portal.siemens.com/productcert/html/ssa-229470.html. If immediate patching is not feasible, the primary compensating control is to enable OPC UA security manually by configuring the application to use Security Mode Sign or Sign&Encrypt with appropriate certificates - note this may require reconfiguration of connected OPC UA clients and could cause connectivity interruptions during the transition. As a defense-in-depth measure, restrict network access to the OPC UA port (default TCP 4840) using firewall rules or OT network segmentation so only authorized engineering workstations and SCADA systems can reach the endpoint. Do not expose the OPC UA interface to corporate IT networks or the internet. Consult the Siemens advisory for any product-specific guidance on OPC UA hardening procedures for these modules.