Out-of-Bounds Write (CVE‑2026‑84854) in Siemens PSS(R)SINCAL’s WibuKey Driver Causes DoS
What It Is – The WibuKey licensing dongle driver bundled with Siemens PSS(R)SINCAL contains an out‑of‑bounds write flaw (CVE‑2026‑84854). When the product is configured to use the legacy WibuKey dongle, crafted input can corrupt a kernel buffer, leading to a crash and denial‑of‑service.
Exploitability – No public exploit code has been released, but the vulnerability is rated CVSS v3.1 7.0 (High) and can be triggered locally by an attacker with access to the licensing interface.
Affected Products – Siemens PSS(R)SINCAL V21.5 (all), V22.0 (all), and V22.5 (versions < 22.5.5).
Why It Matters for Trust & Control Assurance
- Third‑party component oversight – The flaw lives in a vendor‑supplied licensing module, underscoring the need for continuous monitoring of external code and proof of due‑diligence.
- Evidence of patch posture – Demonstrating that you have applied Siemens’ interim mitigations (or disabled legacy dongles) provides audit‑ready evidence of a controlled environment.
- Defensible incident response – Knowing the exact control (license‑management process) that can be abused helps map the incident to a single control objective (secure configuration and vendor‑risk management) that satisfies many frameworks (e.g., NIST CSF 2.0, ISO 27001).
Recommended Actions
- Inventory all PSS(R)SINCAL installations and identify those using the legacy WibuKey dongle.
- Apply Siemens‑provided patches or, where unavailable, follow the vendor’s mitigation guidance (e.g., disable the legacy dongle).
- Update your third‑party risk register to reflect the new vulnerability and record remediation status as continuous assurance evidence.
- Incorporate the licensing component into your regular vulnerability‑scanning and configuration‑baseline checks.
Source: CISA Advisory ICS‑A‑26‑295‑06