PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25571 Siemens CVE debrief

CVE-2026-25571 is a medium-severity issue in Siemens SICAM SIAPP SDK affecting versions before V2.1.7. According to the advisory, the client component does not enforce maximum length checks on certain variables before use, which could let an attacker supply oversized input that triggers a stack overflow, crashes the process, and may result in denial of service. Siemens lists V2.1.7 or later as the fix.

Vendor
Siemens
Product
SICAM SIAPP SDK
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-10
Original CVE updated
2026-03-17
Advisory published
2026-03-10
Advisory updated
2026-03-17

Who should care

Organizations using Siemens SICAM SIAPP SDK, especially those embedding the client component in industrial or operational technology environments, should review whether any deployed products include affected versions below V2.1.7.

Technical summary

The supplied advisory describes a length-validation weakness in the SICAM SIAPP SDK client component. The stated impact is a stack overflow leading to process crash and availability loss. The provided CVSS v3.1 vector is AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, which aligns with availability-only impact and indicates that exploitation is assessed as higher complexity.

Defensive priority

Medium. The issue is not marked as KEV and the disclosed impact is denial of service rather than code execution, but it can still disrupt affected industrial software components if vulnerable versions remain deployed.

Recommended defensive actions

  • Upgrade Siemens SICAM SIAPP SDK to V2.1.7 or later.
  • Inventory products and integrations that include SICAM SIAPP SDK and confirm whether they use affected versions below V2.1.7.
  • Apply vendor and CISA guidance for industrial control system defensive practices, including segmentation and defense-in-depth controls.
  • Monitor for crashes or abnormal termination in components that rely on the affected SDK client functionality.

Evidence notes

All substantive claims are taken from the supplied CISA CSAF advisory record for ICSA-26-076-04 and its Siemens ProductCERT references. The advisory states the affected product as Siemens SICAM SIAPP SDK vers:intdot/<2.1.7, describes missing maximum length checks, and recommends updating to V2.1.7 or later. Timing context uses the supplied publication date of 2026-03-10 and the republication/revision date of 2026-03-17.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25571 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25571

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25571 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25571

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-903736.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-903736.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.