Siemens PSS(R)SINCAL
Plan PatchCVSS 7ICS-CERT ICSA-26-295-06Oct 13, 2026
Siemens
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.
What this means
What could happen
Could allow an attacker to crash or take control of the device
Who's at risk
Organizations in critical infrastructure using Siemens equipment
How it could be exploited
Attacker would need local or console access to the device with basic access credentials
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (3)
1 with fix2 pending
ProductAffected VersionsFix Status
PSS(R)SINCAL V21.5All versionsNo fix yet
PSS(R)SINCAL V22.0All versionsNo fix yet
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
UPGRADEInstall WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from <a href="">User Software - Wibu-Systems</a> and follow the installation instructions from WIBU Systems.
UPGRADEUpdate to V22.5 Update 5 or later version
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/4ea963d2-ec69-43e7-a925-83862856d438Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.