IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SSA-148322: WibuKey Denial of Service Vulnerability in PSS(R)SINCAL

HIGH
CVSS 7.0
Date 2026-10-13T00:00:00+00:00
Source siemens-productcert
Published by Siemens ProductCERT

// Description

PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerability. An attacker could exploit this vulnerability to cause a system crash, resulting in a denial-of-service condition. This affects PSS SINCAL only when configured to use the legacy WibuKey dongle license type. Siemens is actively preparing updates and recommends applicable mitigations for products where patches are currently unavailable.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2026-84854 7.0 high
CVE-2026-84854. In the WibuKey driver, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent kernel memory may be modified.

// Remediations (2)

Mitigation: Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Do
Install WIBU Systems WibuKey Runtime for Windows 6.72 or later version manually to fix the issue: Download the package from <a href="https://www.wibu.com/support/user/user-software.html">User Software - Wibu-Systems</a> and follow the installation instructions from WIBU Systems.
Patch: Update to V22.5 Update 5 or later version
Update to V22.5 Update 5 or later version

// References