Multiple vulnerabilities in SICAM SIAPP SDK before V2.1.7
Plan Patch7.4SSA-903736Mar 10, 2026
Attack VectorLocal
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary
SICAM SIAPP SDK before version 2.1.7 contains multiple buffer overflow and array indexing vulnerabilities (CWE-787, CWE-121, CWE-130, CWE-73) that could allow a local attacker to disrupt the SIAPP application, corrupt application data, or exploit the simulation environment. These vulnerabilities are only exploitable if the SDK API is used improperly or hardening measures are not applied. Siemens has released version 2.1.7 to address these issues.
What this means
What could happen
An attacker with local access to a machine running SICAM SIAPP SDK could crash the application, corrupt data, or gain elevated privileges if the SDK API is used improperly or security hardening is not applied. This affects the simulation and testing environment for SICAM power systems management applications.
Who's at risk
Organizations using SICAM SIAPP SDK for developing or testing power systems management applications. This affects development teams, system integrators, and utilities that build custom SIAPP applications for SICAM platforms used in electric utility control and monitoring systems.
How it could be exploited
An attacker must have local access to the development or simulation environment where SICAM SIAPP SDK is installed. They exploit buffer overflow or array indexing vulnerabilities in the SDK API to write data beyond intended boundaries, leading to denial of service, data corruption, or privilege escalation within the SIAPP process.
Prerequisites
- Local access to the machine running SICAM SIAPP SDK
- The application must use the vulnerable SDK API functions improperly or without hardening
- Specific conditions to trigger the vulnerability in the SDK library (buffer overflow conditions)
Buffer overflow vulnerabilityLocal access requiredAffects development and simulation environmentLow EPSS score indicates low active exploitation risk
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (1)
ProductAffected VersionsFix Status
SICAM SIAPP SDK< 2.1.72.1.7
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate SICAM SIAPP SDK to version 2.1.7 or later
Long-term hardening
0/2HARDENINGReview custom SIAPP code for improper use of SDK API functions and apply input validation and bounds checking
HARDENINGApply security hardening measures recommended by Siemens for SDK usage
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/f3946af8-c791-490b-bcb5-a79d491e4044