Siemens Patches Four Flaws in SICAM 8 Grid Kit, Including a Firmware Signing Bypass

Key points

• Siemens has released firmware version V26.20 for its SICAM 8 family of grid control devices, fixing four security flaws disclosed through CISA in 2026.
• The most serious bug, CVE-2026-54801, scores 7.2 on the CVSS severity scale and lets an authenticated attacker gain elevated privileges through the web API.
• A separate flaw, CVE-2026-54799, lets an attacker with local access install malicious firmware that survives reboots.
• The affected kit runs inside power grids in the Critical Manufacturing and Energy sectors worldwide.
• Siemens says operators should patch, keep devices off the open internet, and put them behind firewalls.

Siemens has shipped fixes for four vulnerabilities in its SICAM 8 line, a family of controllers used by electricity companies to run substations and other parts of the power grid. CISA, the US Cybersecurity and Infrastructure Security Agency, published the advisory after Siemens itself reported the flaws.

The affected products share two firmware bases. CPCI85 covers the CP-8031, CP-8050, and SICAM EGS devices; SICORE covers the CP-8010, CP-8012, and S8000. Both need to reach version 26.20.

None of the four bugs is a remote, no-login catastrophe. All require an attacker who is already inside the network or already holds an account. But these machines keep the lights on, so the bar for "acceptable" is low.

What can an attacker actually do with these bugs?

The answer depends on which flaw they reach first: crash the device, plant persistent firmware, or hand themselves admin rights.

CVE-2026-54801 is the headline, scored 7.2. The web API doesn't properly validate credentials when an admin account is modified, so a low-privilege user can promote themselves. That's the kind of bug that turns a phished contractor account into full control of a substation controller.

CVE-2026-54799 scores 6.5 and lives in the firmware update mechanism. The device doesn't verify the digital signature, the cryptographic stamp proving an update came from Siemens, before installing it. An attacker with local access can load their own firmware, and it'll stay there through reboots. That's the industrial control equivalent of a rootkit: malicious code buried deep enough that normal clean-up procedures won't reach it.

CVE-2026-54798 scores 6.5. Debugging endpoints, left active in shipping code, are reachable over HTTP. An authenticated attacker can hit them to crash the web process and knock the management interface offline. Left-behind debug code in a production product is one of the oldest sins in software.

CVE-2026-54800, the lowest at 4.8, is a configuration choice rather than a coding error. The devices ship with all security features of OPC UA, an industrial communication standard, disabled by default. Plug one in, forget to turn security on, and it's wide open.

Should the public be worried?

Not directly. These devices aren't sitting on home routers. They're inside utility substations, and exploitation needs either network access or an existing login.

The real risk is a targeted attacker: someone who has phished a contractor, gained a foothold on an engineering laptop, or convinced an insider. For that kind of adversary, CVE-2026-54799 is a gift. We noted in our 15 July story on Siemens, Schneider Electric, and Rockwell patches that firmware-level persistence in grid gear is precisely what state-level actors have been caught building toward. This advisory fits that pattern.

Siemens' guidance: patch to V26.20, keep these devices off the public internet, put them behind firewalls, and segment the network so a breach on the IT side can't walk into the operational side. Grid operators are also reminded that redundant physical protection schemes, the fallbacks that stop a single failure from cascading, are part of the defence.

Firmware bundles are on Siemens' industry support portal. If you don't run this kit, file this as a reminder that the machines running the physical world get patched on a schedule measured in months, not hours.