The vulnerability arises from the lack of input length validation in the server component of Siemens SICAM SIAPP SDK. An attacker can send an oversized payload that triggers a stack overflow, potentially crashing the service. This flaw can lead to a denial of service by causing the application to terminate unexpectedly.

The affected product is Siemens SICAM SIAPP SDK, with all versions prior to V2.1.7 impacted. Administrators should verify if their deployments run a vulnerable version and plan an upgrade accordingly.

The CVSS base score of 5.9 indicates a moderate risk level, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. The most likely attack vector is remote, as the server component communicates over the network, but this is inferred from the description rather than explicitly stated. Because the vulnerability only leads to service crashes, it represents a denial of service rather than code execution.