PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-66030 Siemens CVE debrief

CVE-2025-66030 is a medium-severity issue in Siemens SIDIS Prime as published by CISA and Siemens. The advisory describes an integer overflow in node-forge ASN.1 OID processing that can let oversized arcs decode to smaller, trusted OIDs, which may undermine OID-based security checks. Siemens lists version 4.0.800 and later as the fix target.

Vendor
Siemens
Product
SIDIS Prime
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-10
Original CVE updated
2026-03-12
Advisory published
2026-03-10
Advisory updated
2026-03-12

Who should care

Operators and administrators of Siemens SIDIS Prime, OT/ICS security teams, and asset owners who use OID-based certificate or trust validation in affected environments. Any deployment below version 4.0.800 should be prioritized for review.

Technical summary

The advisory says remote, unauthenticated attackers may supply crafted ASN.1 structures with oversized OID arcs. Due to 32-bit bitwise truncation, those arcs can be interpreted as smaller OIDs, potentially bypassing downstream logic that relies on OID values for trust or policy decisions. The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Defensive priority

Medium. The issue is remotely reachable and requires no privileges or user interaction, but the documented impact is integrity-related rather than confidentiality or availability. Patch priority is still important where OIDs drive authentication, certificate, or policy decisions.

Recommended defensive actions

  • Update Siemens SIDIS Prime to version 4.0.800 or later.
  • Inventory all SIDIS Prime instances and confirm which versions are below 4.0.800.
  • Review any workflows that make authorization or trust decisions from OID values.
  • Validate certificate- and ASN.1-handling dependencies in the deployment path.
  • Apply compensating controls and network segmentation until patching is complete.

Evidence notes

CISA's CSAF advisory ICSA-26-071-03 (republished from Siemens ProductCERT SSA-485750) lists CVE-2025-66030 for Siemens SIDIS Prime and ties remediation to version 4.0.800 or later. The source metadata shows publication on 2026-03-10 and modification on 2026-03-12. The advisory description states that oversized OID arcs can be truncated into smaller trusted OIDs, creating a bypass of downstream OID-based security decisions.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-66030 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-66030

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-66030 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-66030

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-071-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-485750.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-485750.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-26-071-03.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.