Intel

CVE-2026-54800

SICAM: Initialization of a Resource with an Insecure Default (CVE-2026-54800)

mediumEPSS 0.2%

Affected

  • Siemens/SICAM range_unparsed *..8 Products <V26.20

Description

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.

Source: siemens_advisoryBSI CSAFBSI WID Portalcvelistv5NVD (NIST)CVE.org (MITRE)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

SiemensSICAM
8 Products <V26.20

Metrics

XIEM Effective CVSS
6.3
Source: nvd-v4
EPSS percentile
12.6 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
54.55
Exploit maturity
no public PoC known
CVSS v3
4.8
CVSS v4
6.3
EPSS score
0.2 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-09 15:16 UTC
CWE
CWE-1188

Weakness classes (CWE)

  • CWE-1188Base

    Initialization of a Resource with an Insecure Default

    The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

    cwe.mitre.org →

References & sources