CVE-2026-54799

MediumCVSS 6.7

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Summary

A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) affects the firmware update signature validation. This flaw allows an attacker to install malicious firmware, leading to persistent code execution and system compromise.

Risk Assessment

The risk for the organization includes potential persistent control over critical industrial systems, which could lead to production downtime, data theft, or sabotage.

Recommendation

Immediately update CPCI85 systems to version V26.20 or later and SICORE Base to version V26.20.0 or later. Restrict network access to these systems and monitor logs for suspicious activity.

Other vulnerabilities in CPCI85 Central Processing/Communication, SICORE Base system

CVE-2026-54800Medium
A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) is caused by a default configuration that disables all OPC UA security mechanisms. This allows an attacker to gain unauthorized access and control over critical system functions.

Original NVD description (English source)

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS