Siemens SICAM SIAPP SDK Stack Overflow Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the Siemens SICAM SIAPP SDK client component, all versions prior to V2.1.7. The vulnerability arises because the SDK does not enforce maximum length checks on certain variables, allowing attackers to send oversized inputs that can trigger stack overflows. This flaw can crash the process, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability can lead to a stack-based buffer overflow, causing the process to crash and potentially allowing for arbitrary code execution, according to the Siemens Security Advisory SSA-903736.

Remediation

Users are advised to update to SICAM SIAPP SDK version 2.1.7 or later. The latest version can be downloaded from the Siemens GitHub repository.