{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type.\n\nSiemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-148322.html"
      },
      {
        "category": "self",
        "summary": "SSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-148322.json"
      }
    ],
    "title": "SSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL",
    "tracking": {
      "current_release_date": "2026-10-13T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-148322",
      "initial_release_date": "2026-10-13T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-13T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "PSS(R)SINCAL V21.5",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "PSS(R)SINCAL V21.5"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "PSS(R)SINCAL V22.0",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "PSS(R)SINCAL V22.0"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c22.5.5",
                "product": {
                  "name": "PSS(R)SINCAL V22.5 \u003c V22.5 Update 5",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "PSS(R)SINCAL V22.5"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84854",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "In the WibuKey driver, insufficient validation of user input when calculating the size of a kernel buffer could cause\r\nsmall amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under\r\nunfavorable circumstances, adjacent kernel memory may be modified.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from \u003ca href=\"https://www.wibu.com/support/user/user-software.html\"\u003eUser Software - Wibu-Systems\u003c/a\u003e and follow the installation instructions from WIBU Systems.",
          "product_ids": [
            "1",
            "2"
          ]
        },
        {
          "category": "none_available",
          "details": "Currently no fix is available",
          "product_ids": [
            "1",
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V22.5 Update 5 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://www.simtec.cc/en/updates.aspx"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "title": "CVE-2026-84854"
    }
  ]
}