CVE-2026-25569
Received Received - Intake
Out-of-Bounds Write in SICAM SIAPP SDK Enables Code Execution

Publication date: 2026-03-10

Last updated on: 2026-03-13

Assigner: Siemens AG

Description
A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). An out-of-bounds write vulnerability exists in SICAM SIAPP SDK. This could allow an attacker to write data beyond the intended buffer, potentially leading to denial of service, or arbitrary code execution.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25569
EUVD
EUVD-2026-10524
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
siemens sicam_siapp_sdk to 2.17 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-25569 is an out-of-bounds write vulnerability found in the Siemens SICAM SIAPP SDK versions earlier than 2.1.7. This vulnerability allows an attacker to write data beyond the intended buffer boundaries.

Such an out-of-bounds write can lead to serious issues like denial of service or arbitrary code execution, meaning an attacker could potentially crash the application or run malicious code.

Impact Analysis

Exploitation of this vulnerability can result in denial of service, causing the affected application or system to crash or become unavailable.

More severely, it can allow an attacker to execute arbitrary code, potentially gaining control over the affected system or application.

Additionally, it may lead to data corruption within customer-developed SIAPP applications or exploitation of the simulation environment.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the vulnerability in SICAM SIAPP SDK (all versions prior to 2.1.7), Siemens recommends updating to version 2.1.7 or later.

Additional mitigation steps include applying Siemens’ security updates using the recommended tooling and procedures, validating updates prior to deployment, and protecting network access through firewalls, network segmentation, and VPNs.

Operators of critical power systems should ensure multi-level redundant secondary protection schemes are in place to minimize the risk of cyber incidents.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart