Technical impact
A denial‑of‑service vulnerability has been identified in the remote operation mode of Siemens CPCI85 Central Processing/Communication and RTUM85 RTU Base. The flaw allows an attacker to flood the device with a high volume of requests, exhausting internal resources such as memory or processing queues, which in turn prevents the proper handling of legitimate requests and forces the device to reset or reboot to regain functionality. The weakness is classified as resource exhaustion (CWE-770).
Affected Systems
Siemens CPCI85 Central Processing/Communication (all versions prior to V26.10) and Siemens RTUM85 RTU Base (all versions prior to V26.10) are affected. Only these pre‑V26.10 builds are vulnerable; newer releases are presumed fixed.
Risk and Exploitability
The CVSS score of 7.1 indicates a moderate to high impact that is feasible for remote exploitation; no authentication is required and the attacker only needs the ability to send repeated requests to the target. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation may be uncommon but still plausible, especially in environments where the remote operation mode is exposed without adequate controls. Unauthorized remote attackers can induce service disruption without affecting confidentiality or integrity of the device’s configuration.
