# CVE-2026-54798: Siemens SICAM 8 active debug code in CPCI85 and SICORE firmware

Source: https://junglewise.ai/threats/cve-2026-54798-siemens-sicam-8-active-debug-code-in-cpci85-and-sicore-firmware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-54798 · Severity: medium · CVSS 6.5 · Published 2026-07-09

Siemens SICAM 8 power automation devices contain a debugging interface that was unintentionally left active in production firmware. An authenticated user could access this interface via the web to crash the device's web service, leading to a denial-of-service condition. This could disrupt the ability of operators to manage or monitor critical power grid infrastructure.

Technologies: [Siemens CPCI85 Central Processing/Communication](https://junglewise.ai/threats/technologies/cpci85-central-processing-communication), [Siemens SICORE Base system](https://junglewise.ai/threats/technologies/sicore-base-system). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-54798 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54798 being exploited in the wild.

**How severe is CVE-2026-54798?** Medium severity, with a CVSS score of 6.5, published 9 July 2026.

**Which products and versions are affected?** Siemens CPCI85 Central Processing/Communication All versions < V26.20; Siemens SICAM A8000 CP-8010/CP-8012 Firmware versions < V26.20.0; Siemens SICAM A8000 CP-8031/CP-8050 Firmware versions < V26.20; Siemens SICAM EGS Firmware versions < V26.20; and 2 more.

**Is there a fix for CVE-2026-54798?** A patch was published on 2026-07-09: Fixes released in version V26.20 / V26.20.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54798 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-54798?** Check whether you run Siemens CPCI85 Central Processing/Communication, Siemens SICAM A8000 CP-8010/CP-8012, Siemens SICAM A8000 CP-8031/CP-8050 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as Active Debug Code (CWE-489) within the CPCI85 and SICORE firmware components. The affected software exposes a debugging interface through HTTP endpoints that should not be accessible in production environments. An attacker with low-privileged network access can interact with these endpoints to trigger a crash of the web process. This results in a denial-of-service (DoS) condition for the web-based management interface. Siemens has addressed this in CPCI85 version V26.20 and SICORE version V26.20.0.

## Affected products

- Siemens CPCI85 Central Processing/Communication All versions < V26.20
- Siemens SICORE Base system All versions < V26.20.0
- Siemens SICAM A8000 CP-8031/CP-8050 Firmware versions < V26.20
- Siemens SICAM A8000 CP-8010/CP-8012 Firmware versions < V26.20.0
- Siemens SICAM EGS Firmware versions < V26.20
- Siemens SICAM S8000 Firmware versions < V26.20.0

## Timeline

- 2026-07-09: advisory: Initial publication of SSA-229470 by Siemens ProductCERT
- 2026-07-09: patched: Fixes released in version V26.20 / V26.20.0

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-229470.html](https://cert-portal.siemens.com/productcert/html/ssa-229470.html)

## Related threats

- [Siemens SICAM 8 privilege escalation in web API](https://junglewise.ai/threats/cve-2026-54801-siemens-sicam-8-privilege-escalation-in-web-api)
- [Siemens SICAM 8 insecure default configuration in OPC UA](https://junglewise.ai/threats/cve-2026-54800-siemens-sicam-8-insecure-default-configuration-in-opc-ua)
- [Siemens CPCI85 and SICORE firmware signature validation bypass](https://junglewise.ai/threats/cve-2026-54799-siemens-cpci85-and-sicore-firmware-signature-validation-bypass)