CVE-2026-25572
Siemens Sicam Siapp Sdk ≤ 2.17
Raw vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-25572 is a medium-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability in Siemens Sicam Siapp Sdk. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10527
Vulnerability Data
A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK server component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input…
more
that could trigger a stack overflow crashing the process and potentially causing denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow via missing length checks directly enables application DoS through exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of input length and format before processing, blocking the oversized data that triggers the stack overflow in the SDK server.
Enforces memory protection mechanisms that can contain or prevent stack-based overflows from crashing the SICAM SIAPP process.
Boundary protection devices can be configured to filter or drop excessively large inputs before they reach the vulnerable SDK component.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce length validation and input sanitization during coding and review.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect length-inconsistency vulnerabilities before deployment.
Secure development lifecycle mandates input validation and length checks that directly address inconsistent length fields.
Application security requirements include explicit rules for handling message lengths and data structures.
Secure architecture principles require robust parsing and bounds checking to prevent length-related flaws.
Secure coding standards directly prohibit improper length handling and enforce defensive parsing practices.