Our takeCISA advisory: Siemens PSS SINCAL is exposed to a WibuKey dongle out-of-bounds write that can crash the system when using legacy licensing. Patch or disable the legacy dongle if you run it; most lean-IT teams and enterprises using modern licensing are unaffected.Security Resilience desk
Sources (1)
- cisa_advisories · cisa_advisories
What this means for you — Security leader:If you use Siemens PSS SINCAL with the legacy WibuKey dongle license, disable it immediately and switch to a different licensing method until Siemens releases the update. Review and restrict any exposed engineering workstations.
What this means for you — Lean IT orgs:If you run Siemens PSS SINCAL engineering software with a physical WibuKey dongle, stop using that license type right away and contact your software vendor for a different option.
What this means for you — MSP:Audit all client environments for Siemens PSS SINCAL using legacy WibuKey dongle licensing and disable it until the Siemens update is available; treat affected engineering workstations as higher risk.
What this means for you — Researcher:Review your Siemens PSS SINCAL deployments for legacy WibuKey dongle usage and prepare to replace it when the update ships.