Multiple vulnerabilities have been identified in **Siemens** SICAM 8 products that could lead to denial of service. **Siemens** has released new versions for the affected products and recommends updating to the latest versions. ### Affected Products The following versions of **Siemens** SICAM 8 Products are affected: * CPCI85 Central Processing/Communication versions < 26.10 (**CVE-2026-27663**, **CVE-2026-27664**) * RTUM85 RTU Base versions < 26.10 (**CVE-2026-27663**) * SICORE Base system versions < 26.10.0 (**CVE-2026-27664**) <div> <table data-tablesaw-minimap="" data-tablesaw-mode="stack"> <thead> <tr> <th data-tablesaw-priority="persist" role="columnheader">CVSS</th> <th role="columnheader">Vendor</th> <th role="columnheader">Equipment</th> <th role="columnheader">Vulnerabilities</th> </tr> </thead> <tbody> <tr> <td>v3 7.5</td> <td>Siemens</td> <td>Siemens SICAM 8 Products</td> <td>Allocation of Resources Without Limits or Throttling, Out-of-bounds Write</td> </tr> </tbody> </table> </div> ### Background * **Critical Infrastructure Sectors:** Critical Manufacturing * **Countries/Areas Deployed:** Worldwide * **Company Headquarters Location:** Germany --- ### Vulnerabilities #### **CVE-2026-27663**: Resource Exhaustion DoS This vulnerability stems from a lack of resource management. The remote operation mode is susceptible to a resource exhaustion condition when subjected to a high volume of requests. Sending multiple requests can exhaust resources, preventing parameterization and requiring a reset or reboot to restore functionality. [View CVE Details](https://www.cve.org/CVERecord?id=CVE-2026-27663) ##### Affected Products: **Siemens SICAM 8 Products** * **Vendor:** Siemens * **Product Version:** CPCI85 Central Processing/Communication, RTUM85 RTU Base * **Product Status:** known_affected **Relevant CWE:** [CWE-770 Allocation of Resources Without Limits or Throttling](https://cwe.mitre.org/data/definitions/770.html) --- #### **CVE-2026-27664**: Out-of-Bounds Write DoS An out-of-bounds write vulnerability exists while parsing specially crafted XML inputs. An unauthenticated attacker could exploit this issue by sending a malicious XML request, potentially causing the service to crash, resulting in a denial-of-service condition. [View CVE Details](https://www.cve.org/CVERecord?id=CVE-2026-27664) ##### Affected Products: **Siemens SICAM 8 Products** * **Vendor:** Siemens * **Product Version:** CPCI85 Central Processing/Communication, SICORE Base system * **Product Status:** known_affected **Relevant CWE:** [CWE-787 Out-of-bounds Write](https://cwe.mitre.org/data/definitions/787.html) --- ### Recommendations **Siemens** strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. It is advised to configure the environment according to operational guidelines to run the devices in a protected IT environment. Recommended security guidelines can be found at: <https://www.siemens.com/gridsecurity> CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability: * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. * Locate control system networks and remote devices behind firewalls and isolate them from business networks. * When remote access is required, use more secure methods, such as Virtual Private Networks (**VPNs**), recognizing **VPNs** may have vulnerabilities and should be updated to the most recent version available. Also recognize **VPN** is only as secure as its connected devices.