CVE-2026-54800: CPCI85 & SICORE OPC UA Default Disabled Security Vulnerability

Technical summary

CVE-2026-54800 affects CPCI85 versions prior to V26.20 and SICORE Base system versions prior to V26.20.0. The root cause is a default configuration that disables OPC UA security mechanisms—specifically authentication, authorization, and encryption controls that protect Industrial Control System (ICS) communication. OPC UA is a machine-to-machine communication protocol common in manufacturing and process automation. With security disabled, an attacker with network access to the affected system can establish OPC UA connections without credentials and interact with exposed functions. The CVSS 3.1 score of 4.8 (MEDIUM severity) reflects the requirement for network access and specific conditions, but acknowledges confidentiality and integrity impact.

Business impact

Affected organizations running CPCI85 or SICORE Base systems face operational risk in connected environments. An attacker could potentially read process data, modify setpoints or control parameters, or disrupt system availability depending on OPC UA exposure and what functions are accessible. In industrial settings—where these central processing units typically operate—unauthorized system modification could lead to product quality issues, safety incidents, or unplanned downtime. The impact is amplified if these systems are connected to networks accessible from the internet or untrusted zones.

Affected systems

CPCI85 Central Processing/Communication (all versions below V26.20) and SICORE Base system (all versions below V26.20.0) are affected. Organizations running these products should check their current deployed versions. The vulnerability does not affect patched versions V26.20 and later.

Exploitability

Exploitation requires network access to the affected system and knowledge of OPC UA protocol mechanics. The attacker does not need valid credentials, as authentication is disabled by default. However, successful exploitation depends on OPC UA being reachable from the attacker's vantage point (e.g., the same network segment or across a routing path). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) indicates network accessibility but higher complexity, suggesting the exploit is feasible for experienced attackers but not trivial. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, which may reflect limited public exploit availability or discovery.

Remediation

Upgrade to CPCI85 version V26.20 or later, or SICORE Base system version V26.20.0 or later. These versions restore OPC UA security mechanisms to their secure defaults. During patching, verify with your Siemens or product-specific advisory that V26.20 is the correct target version and that no intermediate patches are required. Test patches in a controlled environment first, as central processing units are often critical infrastructure.

Patch guidance

Obtain the latest software updates directly from the vendor. For CPCI85, update to V26.20 or a later supported version. For SICORE Base system, update to V26.20.0 or a later supported version. Verify patch availability against the official vendor security advisory before deployment. Plan patching during a maintenance window to minimize operational disruption. After patching, confirm that OPC UA security controls are enabled by reviewing system configuration and performing a basic connectivity test with a known OPC UA client.

Detection guidance

Monitor network traffic for OPC UA connections (TCP port 4840 is the standard, though custom ports may be configured) originating from unexpected sources or destined for your CPCI85/SICORE systems. If possible, enable OPC UA audit logging on the affected system to record connection attempts and data access. Check system logs for OPC UA connections from machines that should not require access. A security assessment should enumerate all OPC UA endpoints and verify that authentication is enabled post-remediation. Network segmentation—isolating ICS systems from untrusted networks—is a key compensating control while patches are pending.

Why prioritize this

Although the CVSS score is MEDIUM (4.8), the vulnerability warrants prompt attention because (1) it affects central processing units that often control critical operations, (2) it requires only network access with no credentials, (3) it has not yet appeared in widespread exploit code but could easily be weaponized, and (4) patching to V26.20 is straightforward. Organizations should prioritize patching systems exposed to untrusted networks or the internet. Internal-only systems in well-segmented networks can follow standard change management, but externally connected instances require expedited treatment.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects that while the attack vector is network-based and requires no privileges or user interaction, the attack complexity is high due to protocol specifics and the impact is limited to confidentiality and integrity (no complete system compromise or availability loss per the vector). However, context matters: in an ICS environment, even moderate integrity impact can have outsized business consequences, so organizations should not rely solely on the numeric score when prioritizing remediation.

Frequently asked questions