CVE-2026-25605
Published: 10 March 2026
Summary
CVE-2026-25605 is a medium-severity External Control of File Name or Path (CWE-73) vulnerability in Siemens Sicam Siapp Sdk. Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique File Deletion (T1070.004); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Rejects externally supplied file or resource identifiers that fail validity checks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability provides local arbitrary file/socket deletion capability (CWE-73) that directly enables data destruction (T1485), service disruption via targeted deletion (T1489), and indicator removal via file deletion (T1070.004).
NVD Description
A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without properly validating the file path or target. An attacker could delete files or sockets that the affected process has permission…
more
to remove, potentially resulting in denial of service or service disruption.
Deeper analysisAI
CVE-2026-25605 is a vulnerability in the SICAM SIAPP SDK, affecting all versions prior to V2.1.7. The issue stems from the application performing file deletion operations without properly validating the file path or target, which allows improper removal of files or sockets that the affected process has permission to delete. This flaw is classified under CWE-73 (External Control of File Name or Path) and carries a CVSS v3.1 base score of 6.7 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H), indicating medium severity with high impacts on integrity and availability but no confidentiality impact.
Exploitation requires local access to the system (AV:L) with no privileges (PR:N), though it demands high attack complexity (AC:H) and no user interaction (UI:N). A successful attacker could delete arbitrary files or sockets accessible to the SICAM SIAPP SDK process, potentially causing denial of service or broader service disruption on the host system.
Siemens has published security advisory SSA-903736, available at https://cert-portal.siemens.com/productcert/html/ssa-903736.html, which provides details on mitigation strategies and patches for this vulnerability.
Details
- CWE(s)