{"id":"CVE-2026-25571","aliases":["EUVD-2026-10526","GHSA-5j43-pp23-m43c"],"status":"published","title":"A vulnerability has been identified in SICAM SIAPP SDK (All versions \u003c V2.1.7). The SICAM SIAPP...","description":"A vulnerability has been identified in SICAM SIAPP SDK (All versions \u003c V2.1.7). The SICAM SIAPP SDK client component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00114,"percentile":0.0148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-130"],"published":"2026-03-10T16:07:55Z","modified":"2026-06-17T10:24:52Z","products":[{"vendor":"siemens","product":"sicam siapp sdk"},{"vendor":"siemens","product":"sicam_siapp_sdk"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-903736.html","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25571"},{"url":"https://github.com/advisories/GHSA-5j43-pp23-m43c"}],"sources":{"cve":[{"id":"CVE-2026-25571","description":"A vulnerability has been identified in SICAM SIAPP SDK (All versions \u003c V2.1.7). The SICAM SIAPP SDK client component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.","status":"published","published":"2026-03-10T16:07:55.079Z","modified":"2026-03-10T16:41:09.458Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-10526","description":"A vulnerability has been identified in SICAM SIAPP SDK (All versions \u003c V2.1.7). The SICAM SIAPP SDK client component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.","status":"published","published":"2026-03-10T16:07:55Z","modified":"2026-03-10T16:41:09Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:05.412027Z"}],"ghsa":[{"id":"GHSA-5j43-pp23-m43c","title":"A vulnerability has been identified in SICAM SIAPP SDK (All versions \u003c V2.1.7). The SICAM SIAPP...","description":"A vulnerability has been identified in SICAM SIAPP SDK (All versions \u003c V2.1.7). The SICAM SIAPP SDK client component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.","status":"published","published":"2026-03-10T18:31:21Z","modified":"2026-03-10T18:31:30Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T15:06:32.599326Z"}],"nvd":[{"id":"CVE-2026-25571","description":"A vulnerability has been identified in SICAM SIAPP SDK (All versions \u003c V2.1.7). The SICAM SIAPP SDK client component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.","status":"published","published":"2026-03-10T18:18:37.01Z","modified":"2026-06-17T10:24:52.627Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:12:08.98071Z"}]}}