NCSC-2026-0225 [1.00] [M/H] Vulnerabilities fixed in Siemens SICORE

unknownCVE-2026-54798 CVE-2026-54799 CVE-2026-54800 CVE-2026-54801

Siemens has fixed vulnerabilities in SICORE Base systems, specifically in versions below V26.20. The vulnerabilities are present in multiple components of the CPCI85 and SICORE Base systems. One vulnerability allows an authenticated attacker to crash the web service via an HTTP-accessible debugging interface, leading to a denial-of-service. Additionally, the firmware update procedure contains a weakness in the validation of firmware signatures, allowing an attacker to install malicious firmware and gain persistent code execution. Furthermore, there is a configuration error where all OPC UA security mechanisms are disabled by default, allowing authentication and authorization to be bypassed and unauthorized access to critical system functions. Finally, there is a vulnerability in the web API that performs insufficient validation of authentication data when making changes to administrative accounts, allowing an authenticated attacker to bypass security controls and escalate privileges. For successful exploitation, the malicious actor must have access to the production environment. It is good practice to not have such an environment publicly accessible.

CSIRTS triage

vendor: Siemens product: SICORE Denial of service Authentication bypassOtheraffected: below V26.20

What: The vulnerabilities allow an authenticated attacker to crash the web service and install malicious firmware, among other issues.
Who is affected: Deployments of SICORE Base systems below version V26.20 are affected.
Urgency: Remediation is urgent due to the potential for denial-of-service and unauthorized access to critical functions.
Action: Update to version V26.20 or later to mitigate the vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch SICORE

Get an email when a new SICORE advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-07-13
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0225

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-547980.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all scored CVEs.
Low exploitation riskCVE-2026-547990.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
Low exploitation riskCVE-2026-548000.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.
Low exploitation riskCVE-2026-548010.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-54798	coverage & exploitation status	NVD · CVE.org
CVE-2026-54799	coverage & exploitation status	NVD · CVE.org
CVE-2026-54800	coverage & exploitation status	NVD · CVE.org
CVE-2026-54801	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.