Siemens CPCI85 & SICORE: Auth Bypass via Web API (<=V26.20)
CVE-2026-54801 Published on July 9, 2026
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.
Weakness Type
Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.
Affected Versions
Siemens CPCI85 Central Processing/Communication:- Before V26.20 is affected.
- Before V26.20.0 is affected.