PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25573 Siemens CVE debrief

CVE-2026-25573 affects Siemens SICAM SIAPP SDK versions prior to V2.1.7. According to the CISA-republished Siemens advisory, the application builds shell commands from caller-provided strings and then executes them, which can let an attacker influence the command being run. Siemens and CISA describe the result as a command injection issue with potential for full system compromise. The advisory was published on 2026-03-10 and republished by CISA on 2026-03-17.

Vendor
Siemens
Product
SICAM SIAPP SDK
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-10
Original CVE updated
2026-03-17
Advisory published
2026-03-10
Advisory updated
2026-03-17

Who should care

Organizations using Siemens SICAM SIAPP SDK, especially product teams embedding the SDK, industrial/OT operators, and security teams responsible for patching or validating Siemens-based applications and appliances.

Technical summary

The advisory identifies unsafe shell-command construction in Siemens SICAM SIAPP SDK. A caller-controlled string can influence the executed command, making command injection possible. The supplied CVSS vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, which CISA lists as HIGH severity. Siemens' remediation is to update to V2.1.7 or later. No KEV listing was provided in the source corpus.

Defensive priority

High

Recommended defensive actions

  • Update Siemens SICAM SIAPP SDK to V2.1.7 or later.
  • Inventory products and integrations that include or depend on the affected SDK.
  • Review any code paths that pass caller-controlled data into shell or command execution routines.
  • Apply least-privilege and defense-in-depth controls to limit blast radius if command execution is abused.
  • Use CISA ICS recommended practices and vendor guidance to harden affected deployments.

Evidence notes

Primary evidence comes from CISA's CSAF advisory ICSA-26-076-04, which republishes Siemens ProductCERT advisory SSA-903736. The source text states that the affected application builds shell commands with caller-provided strings and executes them, enabling command injection and possible full system compromise. The affected product/version is Siemens SICAM SIAPP SDK versions prior to 2.1.7, and the remediation is to update to V2.1.7 or later. The provided CVSS vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No Known Exploited Vulnerabilities entry was included in the corpus.

Official resources

Public advisory published 2026-03-10; CISA republished Siemens ProductCERT advisory content on 2026-03-17. No KEV listing was provided in the supplied corpus.