CVE-2026-27663: Siemens CPCI85/RTUM85 DoS Vulnerability

CVE-2026-27663 Overview

A denial-of-service (DoS) vulnerability has been identified in Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base devices. The affected application contains a resource exhaustion flaw in the remote operation mode that can be exploited when subjected to a high volume of requests. An attacker with adjacent network access can send multiple requests to exhaust system resources, preventing parameterization and requiring a reset or reboot to restore functionality.

Critical Impact

Exploitation can render industrial control system devices non-functional, disrupting critical infrastructure operations and requiring physical intervention to restore normal operation.

Affected Products

• CPCI85 Central Processing/Communication (All versions < V26.10)
• RTUM85 RTU Base (All versions < V26.10)

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-27663 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-27663

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The remote operation mode in affected Siemens industrial control devices lacks proper rate limiting or resource management controls. When an attacker floods the device with requests from an adjacent network position, the system cannot adequately manage or throttle incoming connections, leading to resource depletion.

The attack requires adjacent network access, meaning the attacker must be on the same network segment as the vulnerable device. No authentication or user interaction is required to exploit this vulnerability. While confidentiality and integrity are not impacted, the availability impact is high—the device becomes completely unresponsive and cannot be recovered without a manual reset or reboot.

Root Cause

The root cause is improper resource allocation management in the remote operation mode. The affected systems do not implement adequate rate limiting, connection throttling, or resource quotas to handle scenarios where request volumes exceed normal operational parameters. This allows an attacker to consume all available resources through sustained high-volume request flooding.

Attack Vector

The attack vector requires adjacent network access (AV:A), meaning an attacker must have logical adjacency to the target device—typically being on the same network segment, broadcast domain, or administrative domain. From this position, the attacker can flood the target device with requests without requiring any authentication credentials or user interaction.

The exploitation flow involves:

1. Attacker gains access to the network segment containing the vulnerable CPCI85 or RTUM85 device
2. Attacker sends a high volume of requests to the device's remote operation interface
3. Device resources become exhausted due to lack of rate limiting
4. Device becomes unresponsive and parameterization functions fail
5. Manual reset or reboot is required to restore normal operation

Due to the nature of this vulnerability, the attack is persistent until physical intervention occurs, making it particularly disruptive in operational technology (OT) environments.

Detection Methods for CVE-2026-27663

Indicators of Compromise

• Unusual spike in network traffic directed at CPCI85 or RTUM85 devices from adjacent network hosts
• Device becoming unresponsive to legitimate remote operation commands
• Repeated connection attempts or request floods from single or multiple sources on the local network segment
• Device logs indicating resource exhaustion or memory allocation failures

Detection Strategies

• Implement network traffic analysis to detect abnormal request patterns targeting industrial control devices
• Configure SIEM alerts for high-volume traffic flows to CPCI85 and RTUM85 device addresses
• Monitor device health metrics for signs of resource depletion or degraded performance
• Deploy network behavior anomaly detection at OT network boundaries

Monitoring Recommendations

• Enable logging on affected devices and forward logs to centralized security monitoring systems
• Establish baseline traffic patterns for normal remote operation communications
• Configure network monitoring tools to alert on traffic volume thresholds to critical ICS devices
• Regularly review device availability and response time metrics

How to Mitigate CVE-2026-27663

Immediate Actions Required

• Upgrade CPCI85 Central Processing/Communication devices to version V26.10 or later
• Upgrade RTUM85 RTU Base devices to version V26.10 or later
• Implement network segmentation to restrict adjacent network access to authorized systems only
• Apply firewall rules to limit the rate and source of connections to affected devices

Patch Information

Siemens has released firmware version V26.10 for both CPCI85 and RTUM85 devices to address this vulnerability. Organizations should review the Siemens Security Advisory SSA-246443 for detailed patching instructions and additional mitigation guidance specific to their deployment configurations.

Workarounds

• Restrict network access to affected devices to only trusted hosts using firewall ACLs
• Implement network segmentation to isolate ICS devices from untrusted network segments
• Deploy intrusion prevention systems (IPS) with rate limiting capabilities at network boundaries
• Monitor and limit the number of concurrent connections to affected devices where possible

# Example firewall rule to restrict access to affected devices (adjust IP addresses as needed)
# Allow only trusted management hosts
iptables -A INPUT -p tcp -d <DEVICE_IP> --dport <REMOTE_OPERATION_PORT> -s <TRUSTED_MGMT_HOST> -j ACCEPT
# Drop all other traffic to the device's remote operation port
iptables -A INPUT -p tcp -d <DEVICE_IP> --dport <REMOTE_OPERATION_PORT> -j DROP