PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25569 Siemens CVE debrief

CVE-2026-25569 is an out-of-bounds write vulnerability in Siemens SICAM SIAPP SDK. Siemens and CISA state that affected versions are earlier than V2.1.7, and the vendor remediation is to update to V2.1.7 or later. The advisory describes possible denial of service and arbitrary code execution, with a CVSS 3.1 base score of 7.4 (HIGH).

Vendor
Siemens
Product
SICAM SIAPP SDK
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-10
Original CVE updated
2026-03-17
Advisory published
2026-03-10
Advisory updated
2026-03-17

Who should care

Organizations that use Siemens SICAM SIAPP SDK, especially industrial control system teams, product integrators, and OT security operators responsible for components built with or deployed from affected SDK versions before 2.1.7.

Technical summary

The advisory identifies an out-of-bounds write in SICAM SIAPP SDK, mapped to CWE-787. The provided CVSS vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a local attack path with high complexity and no privileges or user interaction required. Siemens lists the affected product/version range as vers:intdot/<2.1.7 and recommends updating to V2.1.7 or later.

Defensive priority

High for any environment using affected Siemens SICAM SIAPP SDK versions. Prioritize remediation because the flaw can impact confidentiality, integrity, and availability, and the vendor has a specific fixed version.

Recommended defensive actions

  • Inventory where Siemens SICAM SIAPP SDK is used and confirm whether any instance is earlier than V2.1.7.
  • Apply the vendor fix by updating to V2.1.7 or later.
  • If immediate updating is not possible, restrict access to affected systems and minimize local access to hosts running the SDK.
  • Review OT/ICS change windows and test the update in a controlled environment before broad deployment.
  • Monitor vendor and CISA advisory pages for any follow-up guidance or revision history changes.

Evidence notes

This debrief is based on the CISA-republished Siemens ProductCERT advisory ICSA-26-076-04 / SSA-903736 for CVE-2026-25569. The source text explicitly states an out-of-bounds write in SICAM SIAPP SDK, affected product version vers:intdot/<2.1.7, and remediation to update to V2.1.7 or later. The advisory was published on 2026-03-10 and republished by CISA on 2026-03-17.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25569 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25569

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25569 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25569

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-903736.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-903736.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.