Multiple Critical Vulnerabilities in Siemens SIDIS Prime (CVE‑2024‑29857 – CVE‑2026‑22610) Threaten Industrial Control Systems
What It Is – Siemens SIDIS Prime (versions < 4.0.800) contains a cascade of 23 high‑severity flaws across OpenSSL, SQLite, and numerous Node.js packages. Vulnerabilities range from out‑of‑bounds reads/writes and path‑traversal to prototype‑pollution and OS‑command injection, many scoring 8.7 CVSS v3.
Exploitability – Public advisories confirm that several of the flaws are exploitable remotely without authentication. Proof‑of‑concept code for the OpenSSL and Node.js prototype‑pollution bugs has been released, and threat‑actor chatter indicates active scanning of industrial networks for vulnerable SIDIS deployments.
Affected Products – Siemens SIDIS Prime (all releases prior to 4.0.800). The product is a core SCADA/ICS platform used in water, energy, and manufacturing facilities worldwide.
TPRM Impact – A compromised SIDIS instance can give adversaries direct control of process‑control logic, enabling sabotage, data exfiltration, or ransomware deployment against downstream suppliers. Because SIDIS often integrates with third‑party PLCs and ERP systems, a breach can cascade through the supply chain, exposing partner organizations to operational downtime and regulatory penalties.
Recommended Actions –
- Patch Immediately – Deploy Siemens SIDIS Prime 4.0.800 or later across all environments.
- Inventory & Verify – Conduct an exhaustive inventory of all SIDIS instances; confirm version numbers against the advisory.
- Network Segmentation – Isolate SIDIS servers from corporate IT and limit inbound traffic to trusted management subnets.
- Monitor for Indicators – Deploy IDS/IPS signatures for the disclosed CVEs and enable logging of anomalous command‑execution attempts.
- Supply‑Chain Review – Re‑assess contracts with vendors that rely on SIDIS for data exchange; require proof of remediation.
Source: CISA Advisory – ICSA‑26‑071‑03