A flaw in the firmware update mechanism of the Siemens CPCI85 Central Processing/Communication and SICORE Base system allows an attacker to bypass the cryptographic signature validation, permitting installation of malicious firmware. Installing such firmware results in persistent code execution, giving the attacker full control over the affected device once it boots and continues to operate thereafter.

All Siemens CPCI85 Central Processing/Communication devices and all Siemens SICORE Base system devices that run firmware versions earlier than V26.20 (or V26.20.0 for SICORE) are vulnerable. The issue applies to every model variant documented within those product families.

The CVSS score of 8.4 indicates a high severity vulnerability, and the EPSS of less than 1% shows a very low but non-zero probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker must initiate a firmware update, which typically requires network access or valid update credentials. Once the update is performed, the malicious firmware is installed and executed, providing persistent control over the device.