Siemens PSS(R)SINCAL Software Vulnerable to Denial-of-Service via WibuKey Flaw
Siemens PSS(R)SINCAL software is susceptible to a denial-of-service vulnerability stemming from an out-of-bounds write in its third-party WibuKey component, potentially crashing affected systems.
Siemens has disclosed a critical vulnerability, identified as CVE-2026-84854, affecting its PSS(R)SINCAL software. This flaw resides within the WibuKey third-party component, a licensing mechanism used by the software. The vulnerability is characterized as an out-of-bounds write, which can be exploited by an attacker to cause a system crash, leading to a denial-of-service (DoS) condition.
The exploitability of this vulnerability is contingent on the specific configuration of the PSS(R)SINCAL software. It only impacts installations that are configured to use the legacy WibuKey dongle license type. This specificity means that not all deployments of PSS(R)SINCAL are at risk, but those utilizing this particular licensing method are directly affected.
Siemens has detailed the affected versions of PSS(R)SINCAL. Specifically, versions V21.5 and V22.0 are affected in all their configurations. For version V22.5, the vulnerability impacts configurations prior to update 5 (vers:intdot/<22.5.5). The Common Vulnerability Scoring System (CVSS) v3.1 base score for this vulnerability is rated as HIGH with a score of 7, indicating a significant risk.
The technical mechanism behind CVE-2026-84854 involves insufficient validation of user input within the WibuKey driver. This lack of validation allows an attacker to provide input that results in the calculation of an incorrect kernel buffer size. Consequently, small amounts of data can be written outside the intended kernel buffer, potentially corrupting adjacent kernel memory and leading to a system crash.
Siemens is actively working on developing patches to address this vulnerability. However, for some affected versions, a direct fix is not yet available. In the interim, Siemens strongly recommends a mitigation strategy: installing the WibuKey Runtime for Windows version 6.72 or later. Users can obtain this update from the Wibu-Systems website and must follow their provided installation instructions.
This vulnerability impacts critical infrastructure sectors globally, including Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities. The widespread deployment of Siemens' industrial control systems in these sectors underscores the potential impact of such vulnerabilities on essential services.
Siemens advises operators to apply security updates as soon as they become available, using the documented procedures. They also recommend validating any security update before deployment and supervising the update process. Network access protection through firewalls and segmentation, along with adherence to operational guidelines for a protected IT environment, are also emphasized as general security measures.
CISA, in coordination with Siemens ProductCERT, has published this advisory to increase visibility and encourage defensive measures. Organizations are urged to minimize network exposure for control system devices, isolate them from business networks, and use secure remote access methods like VPNs, ensuring these are also kept up-to-date.