PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-7783 Siemens CVE debrief

CVE-2025-7783 is a high-severity issue published on 2026-03-10 and republished by CISA on 2026-03-12 in the Siemens SIDIS Prime advisory (ICSA-26-071-03). The advisory states that insufficiently random values in the form-data component can allow HTTP Parameter Pollution (HPP). Siemens’ remediation is to update SIDIS Prime to V4.0.800 or later. Because the affected component is a software dependency and the advisory provides version ranges, organizations should prioritize inventorying impacted deployments and validating whether any included form-data versions fall below the fixed releases.

Vendor
Siemens
Product
SIDIS Prime
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-10
Original CVE updated
2026-03-12
Advisory published
2026-03-10
Advisory updated
2026-03-12

Who should care

Security teams responsible for Siemens SIDIS Prime deployments, OT/ICS asset owners, application teams maintaining Node.js dependencies, and vulnerability management staff tracking third-party library exposure.

Technical summary

The advisory attributes the issue to insufficiently random values in form-data, associated with lib/form_data.Js, and says it affects form-data versions < 2.5.4, 3.0.0-3.0.3, and 4.0.0-4.0.3. The reported impact is HTTP Parameter Pollution (HPP). The supplied CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, with a score of 8.7 (High). The remediation listed in the CSAF data is to update to V4.0.800 or later.

Defensive priority

High. The advisory assigns a high CVSS score and the issue can affect network-exposed applications through a dependency weakness, so inventory and remediation should be handled promptly.

Recommended defensive actions

  • Confirm whether Siemens SIDIS Prime deployments include the affected form-data versions or affected bundled components.
  • Update to V4.0.800 or later, as listed in the vendor remediation.
  • If immediate upgrade is not possible, isolate or restrict access to affected services and monitor for unexpected parameter-handling behavior.
  • Review dependency management and SBOM records so third-party libraries are tracked for future advisories.
  • Validate with Siemens and CISA advisory references before making change-window decisions in production environments.

Evidence notes

This debrief is based on the supplied CISA CSAF source item for ICSA-26-071-03, which references Siemens ProductCERT advisory SSA-485750 and lists the affected product as Siemens SIDIS Prime vers:intdot/<4.0.800. The advisory text explicitly states: 'Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).' The published date is taken from the CVE/source item metadata (2026-03-10), and the modified date from the same metadata (2026-03-12) with a revision note indicating CISA republication of the Siemens advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-7783 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-7783

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-7783 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-7783

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-071-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-485750.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-485750.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-26-071-03.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.