{ "article": { "assignment_desk_version": "v2", "assignment_rank": 19, "canonical_story_id": "2811afbfae2c34f7", "canonical_url": "/news/story/hc_b84bccd82459666f4acce278/", "cluster_manifest_ids": [ "1790100990136512200", "1790100990136889009", "1790100990136151262" ], "cluster_signature": "title:siemens and lwip address critical infrastructure security vulnerabilities", "cluster_stream_ids": [ "17899764225996764" ], "collapsed_duplicate_domains": [], "computed_evidence_counts": { "claims": 24, "earliest_published": "2026-09-22T00:00:00+00:00", "latest_published": "2026-09-22T00:00:00+00:00", "manifests": 3, "sources": 1, "span_hours": 0.0 }, "cross_domain_evidence": false, "dedupe_reason": "canonical public story", "discovery": { "excluded_manifest_count": 0, "excluded_manifest_ids": [], "manifest_fetch_count": 40, "manifest_fetch_strategy": "seed_clusters_then_high_significance", "mcp_window": { "published_date_from": "2026-09-22", "published_date_to": "2026-09-23" }, "preflight_count": 217, "read_cap": 40, "seed_manifest_fetches": [ { "excluded": 0, "kept": 14, "label": "new-york-legislature", "returned": 14, "source_channel": "new-york-legislature", "stream_id": "17806683660290213" }, { "excluded": 0, "kept": 0, "label": "indiana-legislature", "returned": 0, "source_channel": "indiana-legislature", "stream_id": "17806683632583534" }, { "excluded": 0, "kept": 0, "label": "oklahoma-legislature", "returned": 0, "source_channel": "oklahoma-legislature", "stream_id": "17806683668639071" } ], "seed_preflights": [ { "baseline_daily": 13.428571428571429, "count_24h": 15, "event_count": 0, "high_count": 11, "kind": "stream_cluster", "label": "new-york-legislature", "mcp_count": 14, "score": 49.12, "source_channel": "new-york-legislature", "spike_ratio": 1.12, "stream_id": "17806683660290213" }, { "baseline_daily": 20.785714285714285, "count_24h": 25, "event_count": 0, "high_count": 3, "kind": "stream_cluster", "label": "indiana-legislature", "mcp_count": 0, "score": 35.2, "source_channel": "indiana-legislature", "spike_ratio": 1.2, "stream_id": "17806683632583534" }, { "baseline_daily": 107.14285714285714, "count_24h": 9, "event_count": 0, "high_count": 5, "kind": "stream_cluster", "label": "oklahoma-legislature", "mcp_count": 0, "score": 24.08, "source_channel": "oklahoma-legislature", "spike_ratio": 0.08, "stream_id": "17806683668639071" } ], "strict_filter": "manifest timestamp within trailing 12h" }, "edition_date": "2026-09-23", "edition_slot": "00", "evidence_manifest_ids": [ "1790100990136151262", "1790100990136512200", "1790100990136889009" ], "evidence_stream_ids": [ "17899764225996764" ], "excluded_manifest_ids": [], "featured_claims": [ { "claim_id": "1790101288804947125", "claim_ref": "213be3169662e49081a4ee469058dd9dcfbc404a", "headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "source_channel": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03", "text": "Exploitation of CVE-2026-50093 can lead to unauthorized root-level access on the OIS server." }, { "claim_id": "1790104474451377965", "claim_ref": "e915b3723a921fc3e9ccf6aad9fc04253783f000", "headline": "lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121)", "manifest_id": "1790100990136512200", "source_channel": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-01", "text": "Successful exploitation of CVE-2026-87121 allows an attacker to gain full code execution on the device." } ], "home_domain": "society-law-government", "kind": "domain_digest", "lead_citations": [ { "claim_id": "1790101288804947125", "kind": "claim", "manifest_id": "1790100990136889009" }, { "claim_id": "1790104474451377965", "kind": "claim", "manifest_id": "1790100990136512200" } ], "meta_brief": { "corroborated_takeaways": 0, "facts": [ { "disputed": true, "label": "CVE ID", "readings": [ { "manifest_id": "1790100990136512200", "value": "CVE-2026-87121" }, { "manifest_id": "1790100990136889009", "value": "CVE-2026-50093" }, { "manifest_id": "1790100990136151262", "value": "CVE-2026-31431" } ], "sources": 3 }, { "disputed": false, "label": "CVSS v3.1 Score", "readings": [ { "manifest_id": "1790100990136512200", "value": "9.8" } ], "sources": 1 }, { "disputed": false, "label": "CVSS v4.0 Score", "readings": [ { "manifest_id": "1790100990136512200", "value": "9.3" } ], "sources": 1 }, { "disputed": false, "label": "Versions", "readings": [ { "manifest_id": "1790100990136512200", "value": ">=2.0.1|<=2.2.1" } ], "sources": 1 }, { "disputed": false, "label": "CWE Category", "readings": [ { "manifest_id": "1790100990136512200", "value": "CWE-787 Out-of-bounds Write" } ], "sources": 1 }, { "disputed": false, "label": "Severity", "readings": [ { "manifest_id": "1790100990136889009", "value": "CRITICAL" } ], "sources": 1 }, { "disputed": false, "label": "CWE", "readings": [ { "manifest_id": "1790100990136889009", "value": "CWE-434" } ], "sources": 1 }, { "disputed": false, "label": "CVSS Base Score", "readings": [ { "manifest_id": "1790100990136151262", "value": "7.8" } ], "sources": 1 }, { "disputed": false, "label": "CVSS Severity", "readings": [ { "manifest_id": "1790100990136151262", "value": "HIGH" } ], "sources": 1 }, { "disputed": false, "label": "CWE ID", "readings": [ { "manifest_id": "1790100990136151262", "value": "CWE-669" } ], "sources": 1 }, { "disputed": false, "label": "Version", "readings": [ { "manifest_id": "1790100990136151262", "value": "V21 Update 2 SR1" } ], "sources": 1 } ], "manifest_count": 3, "open_questions": [ { "manifest_ids": [ "1790100990136512200" ], "sources": 1, "text": "No reports of active exploitation in the wild have been confirmed by CISA at this time." } ], "quotes": [ { "context": "This statement defines the primary security risk posed by the vulnerability.", "manifest_id": "1790100990136512200", "text": "Successful exploitation of this vulnerability could allow an attacker to gain full code execution" } ], "source_tldrs": [ { "manifest_id": "1790100990136512200", "text": "A critical out-of-bounds write vulnerability (CVE-2026-87121) in lwIP MQTT Client versions 2.0.1-2.2.1 allows full code execution; users must update via the official repository." }, { "manifest_id": "1790100990136889009", "text": "Siemens Siveillance Control and Pro products are vulnerable to arbitrary file uploads, enabling root-level server access; immediate patching is required." }, { "manifest_id": "1790100990136151262", "text": "Siemens warns of a high-severity 'Copy Fail' vulnerability (CVE-2026-31431) in multiple SIMATIC and SIPLUS industrial products, requiring immediate firmware updates." } ], "stakes": [ { "manifest_id": "1790100990136512200", "text": "This flaw poses a severe risk to critical infrastructure sectors, including energy, water, and healthcare, where lwIP is commonly deployed. Immediate patching is required to prevent potential remote exploitation." }, { "manifest_id": "1790100990136889009", "text": "Organizations using Siveillance Control face critical risk of full system compromise; immediate patching is required to mitigate unauthorized root access." }, { "manifest_id": "1790100990136151262", "text": "Industrial operators must patch these devices to mitigate potential unauthorized resource access, as the flaw impacts critical infrastructure sectors including energy and manufacturing." } ], "takeaways": [ { "manifest_ids": [ "1790100990136512200" ], "sources": 1, "text": "The vulnerability (CVE-2026-87121) carries a CVSS v3.1 base score of 9.8, indicating a critical severity level." }, { "manifest_ids": [ "1790100990136512200" ], "sources": 1, "text": "Successful exploitation allows an attacker to gain full code execution on the target device without requiring authentication." }, { "manifest_ids": [ "1790100990136512200" ], "sources": 1, "text": "The fix is available via a specific commit (f89407ea711879c04d91c92b35d67be78bbaf0f1) in the official lwIP repository." }, { "manifest_ids": [ "1790100990136512200" ], "sources": 1, "text": "CISA recommends isolating control system networks behind firewalls and minimizing internet exposure to mitigate potential exploitation risks." }, { "manifest_ids": [ "1790100990136512200" ], "sources": 1, "text": "Update the lwIP TCP/IP Stack MQTT Client Application to a version containing the fix from the official repository." }, { "manifest_ids": [ "1790100990136512200" ], "sources": 1, "text": "Isolate control system networks and remote devices behind firewalls to prevent unauthorized internet access." }, { "manifest_ids": [ "1790100990136889009" ], "sources": 1, "text": "CVE-2026-50093 carries a CVSS base score of 9.0, classified as critical." }, { "manifest_ids": [ "1790100990136889009" ], "sources": 1, "text": "The vulnerability stems from an unrestricted file upload flaw (CWE-434) in the OIS web module." } ] }, "newsworthiness_score": { "audience_fit": 0.55, "breadth": 0.345833, "domain_priority": 0.96, "materiality": 0.9, "novelty": 1.0, "source_strength": 0.85, "total": 0.77325 }, "paragraphs": [], "phase": "curated_synthesis", "primary_home_domain": "society-law-government", "prompt_version": "news_editorial_v2", "schema_version": 1, "secondary_home_domains": [], "seed_candidates": [ { "baseline_daily": 13.428571428571429, "count_24h": 15, "event_count": 0, "high_count": 11, "kind": "stream_cluster", "label": "new-york-legislature", "score": 49.12, "source_channel": "new-york-legislature", "spike_ratio": 1.12, "stream_id": "17806683660290213" }, { "baseline_daily": 20.785714285714285, "count_24h": 25, "event_count": 0, "high_count": 3, "kind": "stream_cluster", "label": "indiana-legislature", "score": 35.2, "source_channel": "indiana-legislature", "spike_ratio": 1.2, "stream_id": "17806683632583534" }, { "baseline_daily": 32.42857142857143, "count_24h": 9, "event_count": 0, "high_count": 5, "kind": "stream_cluster", "label": "state-legislature-ok-2600-bills", "score": 24.28, "source_channel": null, "spike_ratio": 0.28, "stream_id": null }, { "baseline_daily": 107.14285714285714, "count_24h": 9, "event_count": 0, "high_count": 5, "kind": "stream_cluster", "label": "oklahoma-legislature", "score": 24.08, "source_channel": "oklahoma-legislature", "spike_ratio": 0.08, "stream_id": "17806683668639071" }, { "baseline_daily": 10.857142857142858, "count_24h": 8, "event_count": 0, "high_count": 5, "kind": "stream_cluster", "label": "federal-court-opinions", "score": 23.74, "source_channel": "federal-court-opinions", "spike_ratio": 0.74, "stream_id": "17779350937998955" }, { "baseline_daily": 0.21428571428571427, "count_24h": 4, "event_count": 0, "high_count": 2, "kind": "stream_cluster", "label": "magyar-nemzeti-bank-inflation-report-replacement", "score": 20.0, "source_channel": null, "spike_ratio": 18.67, "stream_id": null }, { "baseline_daily": 4.0, "count_24h": 6, "event_count": 0, "high_count": 3, "kind": "stream_cluster", "label": "white-house", "score": 16.5, "source_channel": "white-house", "spike_ratio": 1.5, "stream_id": "17780896674919492" }, { "baseline_daily": 7.357142857142857, "count_24h": 8, "event_count": 0, "high_count": 2, "kind": "stream_cluster", "label": "massachusetts-legislature", "score": 15.09, "source_channel": "massachusetts-legislature", "spike_ratio": 1.09, "stream_id": "17806683643228746" }, { "baseline_daily": 0.42857142857142855, "count_24h": 3, "event_count": 0, "high_count": 1, "kind": "stream_cluster", "label": "new-york-state-executive", "score": 13.0, "source_channel": "new-york-state-executive", "spike_ratio": 7.0, "stream_id": "17807223873959123" }, { "baseline_daily": 0.42857142857142855, "count_24h": 2, "event_count": 0, "high_count": 2, "kind": "stream_cluster", "label": "us-court-of-appeals-for-the-eighth-circuit", "score": 12.67, "source_channel": "us-court-of-appeals-for-the-eighth-circuit", "spike_ratio": 4.67, "stream_id": "17779543024868647" }, { "baseline_daily": 0.21428571428571427, "count_24h": 1, "event_count": 0, "high_count": 1, "kind": "stream_cluster", "label": "peterson-institute", "score": 8.67, "source_channel": null, "spike_ratio": 4.67, "stream_id": null }, { "baseline_daily": 20.5, "count_24h": 2, "event_count": 0, "high_count": 2, "kind": "stream_cluster", "label": "bloomberg", "score": 8.1, "source_channel": null, "spike_ratio": 0.1, "stream_id": null } ], "slug": "00-19-siemens-lwip-infrastructure-vulnerabilities", "source_manifests": [ { "brief": { "actionable_takeaways": [ "Update the lwIP TCP/IP Stack MQTT Client Application to a version containing the fix from the official repository.", "Isolate control system networks and remote devices behind firewalls to prevent unauthorized internet access." ], "facts": [ { "label": "CVE ID", "value": "CVE-2026-87121" }, { "label": "CVSS v3.1 Score", "value": "9.8" }, { "label": "CVSS v4.0 Score", "value": "9.3" }, { "label": "Versions", "value": ">=2.0.1|<=2.2.1" }, { "label": "CWE Category", "value": "CWE-787 Out-of-bounds Write" } ], "key_insights": [ "The vulnerability (CVE-2026-87121) carries a CVSS v3.1 base score of 9.8, indicating a critical severity level.", "Successful exploitation allows an attacker to gain full code execution on the target device without requiring authentication.", "The fix is available via a specific commit (f89407ea711879c04d91c92b35d67be78bbaf0f1) in the official lwIP repository.", "CISA recommends isolating control system networks behind firewalls and minimizing internet exposure to mitigate potential exploitation risks." ], "notable_quotes": [ { "context": "This statement defines the primary security risk posed by the vulnerability.", "text": "Successful exploitation of this vulnerability could allow an attacker to gain full code execution" } ], "tldr": "A critical out-of-bounds write vulnerability (CVE-2026-87121) in lwIP MQTT Client versions 2.0.1-2.2.1 allows full code execution; users must update via the official repository.", "unresolved": [ "No reports of active exploitation in the wild have been confirmed by CISA at this time." ], "why_it_matters": "This flaw poses a severe risk to critical infrastructure sectors, including energy, water, and healthcare, where lwIP is commonly deployed. Immediate patching is required to prevent potential remote exploitation." }, "claim_count": 8, "claims": [ { "claim_id": "1790104474448273502", "claim_ref": "bd2bb1bceff529f2546b0630dd883d4ea1b773c7", "snapshot": "{\"claim_id\":\"1790104474448273502\",\"claim_text\":\"The lwIP TCP/IP Stack MQTT Client Application is vulnerable to an out-of-bounds write.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"lwIP TCP/IP Stack MQTT Client Application\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":true,\"key_point_index\":1,\"quote\":\"The affected product is vulnerable to an out-of-bounds write\",\"signal\":\"Monitor for potential exploitation attempts targeting this specific memory corruption vulnerability in industrial control systems.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The lwIP TCP/IP Stack MQTT Client Application is vulnerable to an out-of-bounds write." }, { "claim_id": "1790104474451377965", "claim_ref": "e915b3723a921fc3e9ccf6aad9fc04253783f000", "snapshot": "{\"claim_id\":\"1790104474451377965\",\"claim_text\":\"Successful exploitation of CVE-2026-87121 allows an attacker to gain full code execution on the device.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"lwIP TCP/IP Stack MQTT Client Application\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":true,\"key_point_index\":1,\"quote\":\"Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device.\",\"signal\":\"Alert security teams to the high-impact nature of this vulnerability, which requires immediate remediation.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Successful exploitation of CVE-2026-87121 allows an attacker to gain full code execution on the device." }, { "claim_id": "1790104474455456103", "claim_ref": "9582f155006927bf0125d06fb91d45a28e0eff19", "snapshot": "{\"claim_id\":\"1790104474455456103\",\"claim_text\":\"The CVSS v3.1 base score for CVE-2026-87121 is 9.8.\",\"claim_type\":\"data\",\"confidence\":\"measured\",\"entities\":[{\"name\":\"lwIP TCP/IP Stack MQTT Client Application\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"observed\",\"featured\":true,\"key_point_index\":0,\"quote\":null,\"signal\":\"Benchmark this vulnerability against internal risk thresholds for critical infrastructure security.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The CVSS v3.1 base score for CVE-2026-87121 is 9.8." }, { "claim_id": "1790104474458733008", "claim_ref": "32739b3b30ba036a7c81941c0cb132dfad220c39", "snapshot": "{\"claim_id\":\"1790104474458733008\",\"claim_text\":\"The fix for CVE-2026-87121 is contained in commit identifier f89407ea711879c04d91c92b35d67be78bbaf0f1.\",\"claim_type\":\"event\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"lwIP\",\"role\":\"subject\",\"type\":\"organization\"}],\"evidence\":\"direct_quote\",\"featured\":true,\"key_point_index\":2,\"quote\":\"The commit identifier that contains the fix is f89407ea711879c04d91c92b35d67be78bbaf0f1.\",\"signal\":\"Route this commit identifier to engineering and maintenance teams for immediate patch deployment.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The fix for CVE-2026-87121 is contained in commit identifier f89407ea711879c04d91c92b35d67be78bbaf0f1." }, { "claim_id": "1790104474462502489", "claim_ref": "e67a23aa45806c8866f8cb8b5a3768d27fb898d4", "snapshot": "{\"claim_id\":\"1790104474462502489\",\"claim_text\":\"CISA recommends minimizing network exposure for all control system devices.\",\"claim_type\":\"analysis\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"CISA\",\"role\":\"source_org\",\"tag_id\":\"17733541052242893\",\"type\":\"organization\"}],\"evidence\":\"paraphrase\",\"featured\":true,\"key_point_index\":3,\"quote\":null,\"signal\":\"Update network security policies to ensure control systems are not accessible from the internet.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "CISA recommends minimizing network exposure for all control system devices." }, { "claim_id": "1790104474453637848", "claim_ref": "6fa90407076549841ff4b3536cec65add3008a03", "snapshot": "{\"claim_id\":\"1790104474453637848\",\"claim_text\":\"Versions of lwIP TCP/IP Stack MQTT Client Application from 2.0.1 to 2.2.1 are affected by CVE-2026-87121.\",\"claim_type\":\"data\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"lwIP TCP/IP Stack MQTT Client Application\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"paraphrase\",\"featured\":false,\"key_point_index\":null,\"quote\":null,\"signal\":\"Update asset inventory and vulnerability management systems to identify devices running these specific versions.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Versions of lwIP TCP/IP Stack MQTT Client Application from 2.0.1 to 2.2.1 are affected by CVE-2026-87121." }, { "claim_id": "1790104474457623256", "claim_ref": "b498448d75163ffcc2680fdb26f393290a1bdbb1", "snapshot": "{\"claim_id\":\"1790104474457623256\",\"claim_text\":\"The CVSS v4.0 base score for CVE-2026-87121 is 9.3.\",\"claim_type\":\"data\",\"confidence\":\"measured\",\"entities\":[{\"name\":\"lwIP TCP/IP Stack MQTT Client Application\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"observed\",\"featured\":false,\"key_point_index\":null,\"quote\":null,\"signal\":\"Benchmark this vulnerability against internal risk thresholds for critical infrastructure security.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The CVSS v4.0 base score for CVE-2026-87121 is 9.3." }, { "claim_id": "1790104474460305536", "claim_ref": "46e6ceaee8a47d0a56dd79b4098b02f4e8d4702d", "snapshot": "{\"claim_id\":\"1790104474460305536\",\"claim_text\":\"Shahriyar Jalayeri of ByteRay Ltd. reported the vulnerability to CISA.\",\"claim_type\":\"event\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Shahriyar Jalayeri\",\"role\":\"mentioned\",\"tag_id\":\"17901020007754443\",\"type\":\"person\"},{\"name\":\"ByteRay Ltd.\",\"role\":\"mentioned\",\"tag_id\":\"17901020060849173\",\"type\":\"organization\"}],\"evidence\":\"paraphrase\",\"featured\":false,\"key_point_index\":null,\"quote\":null,\"signal\":\"Track vulnerability research contributions from ByteRay Ltd. for future threat intelligence assessments.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Shahriyar Jalayeri of ByteRay Ltd. reported the vulnerability to CISA." } ], "entities": [], "headline": "lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121)", "home_domain": null, "manifest_id": "1790100990136512200", "published_at": "2026-09-22", "significance": "high", "source_channel": "Cisa Cybersecurity Advisories Rss", "source_name": "cisa-cybersecurity-advisories-rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-01", "stream_id": null, "stream_ids": [ "17899764225996764" ], "summary": "CISA identified a critical out-of-bounds write vulnerability in the lwIP TCP/IP Stack MQTT Client Application, tracked as CVE-2026-87121. Versions 2.0.1 through 2.2.1 are susceptible, potentially enabling full remote code execution. Users are advised to update their software immediately using the provided repository fix.", "tags": [ "Cybersecurity", "CISA" ] }, { "brief": { "actionable_takeaways": [ "Siveillance Control and Siveillance Control Pro to the latest patched versions (3.0.12.2173, 3.0.22.2177, 4.0.11.2177, or 4.0.9.2178).", "Minimize network exposure for control system devices and isolate them from business networks." ], "facts": [ { "label": "CVE ID", "value": "CVE-2026-50093" }, { "label": "Severity", "value": "CRITICAL" }, { "label": "CWE", "value": "CWE-434" } ], "key_insights": [ "CVE-2026-50093 carries a CVSS base score of 9.0, classified as critical.", "The vulnerability stems from an unrestricted file upload flaw (CWE-434) in the OIS web module.", "CISA advises isolating control system networks behind firewalls and minimizing internet exposure." ], "tldr": "Siemens Siveillance Control and Pro products are vulnerable to arbitrary file uploads, enabling root-level server access; immediate patching is required.", "why_it_matters": "Organizations using Siveillance Control face critical risk of full system compromise; immediate patching is required to mitigate unauthorized root access." }, "claim_count": 8, "claims": [ { "claim_id": "1790101288804947125", "claim_ref": "213be3169662e49081a4ee469058dd9dcfbc404a", "snapshot": "{\"claim_id\":\"1790101288804947125\",\"claim_text\":\"Exploitation of CVE-2026-50093 can lead to unauthorized root-level access on the OIS server.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siveillance Control\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":true,\"key_point_index\":0,\"quote\":\"which can lead to unauthorized root-level access on the OIS server.\",\"signal\":\"Alert security teams to the high risk of full system compromise.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Exploitation of CVE-2026-50093 can lead to unauthorized root-level access on the OIS server." }, { "claim_id": "1790101288820806514", "claim_ref": "087ed87793b6b71099b0fb38568abdfa9ec26325", "snapshot": "{\"claim_id\":\"1790101288820806514\",\"claim_text\":\"The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siveillance Control\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":true,\"key_point_index\":1,\"quote\":\"Relevant CWE: CWE-434 Unrestricted Upload of File with Dangerous Type\",\"signal\":\"Update compliance and vulnerability management databases.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type." }, { "claim_id": "1790101288823492626", "claim_ref": "e499371faed6f66aaf2f7e29a78e3e2ebd7d4761", "snapshot": "{\"claim_id\":\"1790101288823492626\",\"claim_text\":\"The CVSS 3.1 base score for this vulnerability is 9.0 (Critical).\",\"claim_type\":\"data\",\"confidence\":\"measured\",\"entities\":[{\"name\":\"Siveillance Control\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":true,\"key_point_index\":0,\"quote\":\"Base Score 9\",\"signal\":\"Prioritize patching based on the critical severity score.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The CVSS 3.1 base score for this vulnerability is 9.0 (Critical)." }, { "claim_id": "1790101288825976574", "claim_ref": "cf1a42f0ca65f21ac6c7e17e6f7023f59f6b135d", "snapshot": "{\"claim_id\":\"1790101288825976574\",\"claim_text\":\"Siveillance Control Pro V3.0 versions before 3.0.12.2173 are affected.\",\"claim_type\":\"data\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siveillance Control Pro\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":true,\"key_point_index\":2,\"quote\":\"Siveillance Control Pro V3.0 vers:intdot/<3.0.12.2173\",\"signal\":\"Diligence check for version compliance in industrial environments.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Siveillance Control Pro V3.0 versions before 3.0.12.2173 are affected." }, { "claim_id": "1790101288834916363", "claim_ref": "5d84402a4a9a6845a3d262508c5de79c94e7e708", "snapshot": "{\"claim_id\":\"1790101288834916363\",\"claim_text\":\"CISA recommends minimizing network exposure for all control system devices.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"CISA\",\"role\":\"subject\",\"tag_id\":\"17733541052242893\",\"type\":\"organization\"}],\"evidence\":\"direct_quote\",\"featured\":true,\"key_point_index\":3,\"quote\":\"Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.\",\"signal\":\"Update network architecture guidelines for industrial control systems.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "CISA recommends minimizing network exposure for all control system devices." }, { "claim_id": "1790101288780719536", "claim_ref": "5bc31abe2386dd26304ce69baade08bb673ae657", "snapshot": "{\"claim_id\":\"1790101288780719536\",\"claim_text\":\"Siemens Siveillance Control and Siveillance Control Pro are affected by a vulnerability in the OIS web module.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siemens\",\"role\":\"subject\",\"tag_id\":\"17733519562519782\",\"type\":\"organization\"},{\"name\":\"Siveillance Control\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":false,\"key_point_index\":null,\"quote\":\"A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro\",\"signal\":\"Monitor for potential impact on industrial control environments using these products.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Siemens Siveillance Control and Siveillance Control Pro are affected by a vulnerability in the OIS web module." }, { "claim_id": "1790101288791092839", "claim_ref": "bff7926b8d621597e94bbf0b0ae7132537b050b6", "snapshot": "{\"claim_id\":\"1790101288791092839\",\"claim_text\":\"The vulnerability (CVE-2026-50093) allows an attacker to upload arbitrary files to the server.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siveillance Control\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":false,\"key_point_index\":null,\"quote\":\"This vulnerability allows an attacker to upload arbitrary files\",\"signal\":\"Track this vulnerability in risk models for industrial control systems.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The vulnerability (CVE-2026-50093) allows an attacker to upload arbitrary files to the server." }, { "claim_id": "1790101288827719541", "claim_ref": "97080cb774d1117e1fe8ae05c34f8bfcec72afc6", "snapshot": "{\"claim_id\":\"1790101288827719541\",\"claim_text\":\"Siveillance Control Pro V4.0 versions before 4.0.9.2178 are affected.\",\"claim_type\":\"data\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siveillance Control Pro\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"direct_quote\",\"featured\":false,\"key_point_index\":null,\"quote\":\"Siveillance Control Pro V4.0 vers:intdot/<4.0.9.2178\",\"signal\":\"Diligence check for version compliance in industrial environments.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Siveillance Control Pro V4.0 versions before 4.0.9.2178 are affected." } ], "entities": [], "headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "home_domain": null, "manifest_id": "1790100990136889009", "published_at": "2026-09-22", "significance": "high", "source_channel": "Cisa Cybersecurity Advisories Rss", "source_name": "cisa-cybersecurity-advisories-rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03", "stream_id": null, "stream_ids": [ "17899764225996764" ], "summary": "A critical vulnerability in the Open Interface Services (OIS) web module of Siemens Siveillance Control and Siveillance Control Pro allows attackers to upload arbitrary files. Successful exploitation can lead to unauthorized root-level access on the OIS server. Siemens has released patches for affected versions and recommends immediate updates to mitigate the risk.", "tags": [ "Siemens", "CISA", "Cybersecurity Incident" ] }, { "brief": { "actionable_takeaways": [ "Update affected Siemens SIPLUS and SIMATIC products to V21 Update 2 SR1 or later.", "Restrict access to the interactive shell of the GNU/Linux subsystem to trusted personnel only." ], "facts": [ { "label": "CVE ID", "value": "CVE-2026-31431" }, { "label": "CVSS Base Score", "value": "7.8" }, { "label": "CVSS Severity", "value": "HIGH" }, { "label": "CWE ID", "value": "CWE-669" }, { "label": "Version", "value": "V21 Update 2 SR1" } ], "key_insights": [ "The vulnerability stems from incorrect resource transfer between spheres (CWE-669) within the Linux kernel.", "Affected products include various SIMATIC HMI panels, IoT2050 devices, and industrial edge device operating systems.", "Siemens advises restricting access to the GNU/Linux subsystem to trusted personnel and ensuring applications are sourced from trusted origins." ], "tldr": "Siemens warns of a high-severity 'Copy Fail' vulnerability (CVE-2026-31431) in multiple SIMATIC and SIPLUS industrial products, requiring immediate firmware updates.", "why_it_matters": "Industrial operators must patch these devices to mitigate potential unauthorized resource access, as the flaw impacts critical infrastructure sectors including energy and manufacturing." }, "claim_count": 8, "claims": [ { "claim_id": "1790101289482838295", "claim_ref": "862b54042941d35086529d7cd62701efe74511b8", "snapshot": "{\"claim_id\":\"1790101289482838295\",\"claim_text\":\"Multiple Siemens SIPLUS and SIMATIC products are vulnerable to the 'Copy Fail' vulnerability.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siemens\",\"role\":\"subject\",\"tag_id\":\"17733519562519782\",\"type\":\"organization\"}],\"evidence\":\"paraphrase\",\"featured\":true,\"key_point_index\":1,\"quote\":null,\"signal\":\"Monitor asset inventory for these specific Siemens product lines.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Multiple Siemens SIPLUS and SIMATIC products are vulnerable to the 'Copy Fail' vulnerability." }, { "claim_id": "1790101289489799507", "claim_ref": "d953b49f6beb68b062fe930524822c6c9ac4e05c", "snapshot": "{\"claim_id\":\"1790101289489799507\",\"claim_text\":\"The vulnerability is classified as CWE-669: Incorrect Resource Transfer Between Spheres.\",\"claim_type\":\"analysis\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"CVE-2026-31431\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"paraphrase\",\"featured\":true,\"key_point_index\":0,\"quote\":null,\"signal\":\"Update compliance and security policy trackers with this CWE classification.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The vulnerability is classified as CWE-669: Incorrect Resource Transfer Between Spheres." }, { "claim_id": "1790101289496466734", "claim_ref": "88fb8a968fe8e299b309b18f88cd585917c31d8c", "snapshot": "{\"claim_id\":\"1790101289496466734\",\"claim_text\":\"Siemens advises limiting access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siemens\",\"role\":\"subject\",\"tag_id\":\"17733519562519782\",\"type\":\"organization\"}],\"evidence\":\"paraphrase\",\"featured\":true,\"key_point_index\":2,\"quote\":null,\"signal\":\"Update access control policies for industrial devices.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Siemens advises limiting access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only." }, { "claim_id": "1790101289484908242", "claim_ref": "ab7baa0a80d4e2dc127d89edd9d5ab383042f593", "snapshot": "{\"claim_id\":\"1790101289484908242\",\"claim_text\":\"The 'Copy Fail' vulnerability is identified as CVE-2026-31431.\",\"claim_type\":\"data\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"CVE-2026-31431\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"paraphrase\",\"featured\":false,\"key_point_index\":null,\"quote\":null,\"signal\":\"Track CVE-2026-31431 in vulnerability management systems.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The 'Copy Fail' vulnerability is identified as CVE-2026-31431." }, { "claim_id": "1790101289487741276", "claim_ref": "3852d370721e35027a6848e58e97c65083c7e895", "snapshot": "{\"claim_id\":\"1790101289487741276\",\"claim_text\":\"The vulnerability has a CVSS v3.1 base score of 7.8.\",\"claim_type\":\"data\",\"confidence\":\"measured\",\"entities\":[{\"name\":\"CVE-2026-31431\",\"role\":\"subject\",\"type\":\"topic\"}],\"evidence\":\"paraphrase\",\"featured\":false,\"key_point_index\":null,\"quote\":null,\"signal\":\"Use this score to prioritize patching in risk models.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The vulnerability has a CVSS v3.1 base score of 7.8." }, { "claim_id": "1790101289491295145", "claim_ref": "9b60b471ddd5e45001b16147568bf6bc85d3a266", "snapshot": "{\"claim_id\":\"1790101289491295145\",\"claim_text\":\"The vulnerability originates in the Linux kernel's algif_aead implementation.\",\"claim_type\":\"analysis\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Linux kernel\",\"role\":\"subject\",\"tag_id\":\"17801849369387329\",\"type\":\"topic\"}],\"evidence\":\"paraphrase\",\"featured\":false,\"key_point_index\":null,\"quote\":null,\"signal\":\"Investigate Linux kernel dependencies in industrial control systems.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "The vulnerability originates in the Linux kernel's algif_aead implementation." }, { "claim_id": "1790101289493771482", "claim_ref": "b7f8c2f0ad837b0d9a96b9035fda391843e562c5", "snapshot": "{\"claim_id\":\"1790101289493771482\",\"claim_text\":\"Siemens recommends updating affected products to V21 Update 2 SR1 or later.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siemens\",\"role\":\"subject\",\"tag_id\":\"17733519562519782\",\"type\":\"organization\"}],\"evidence\":\"paraphrase\",\"featured\":false,\"key_point_index\":null,\"quote\":null,\"signal\":\"Initiate firmware update procurement and deployment plan.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Siemens recommends updating affected products to V21 Update 2 SR1 or later." }, { "claim_id": "1790101289498222299", "claim_ref": "86269da27d3c9507e24ce46ce2791c2565b7e2c1", "snapshot": "{\"claim_id\":\"1790101289498222299\",\"claim_text\":\"Siemens recommends only building and running applications from trusted sources.\",\"claim_type\":\"statement\",\"confidence\":\"stated\",\"entities\":[{\"name\":\"Siemens\",\"role\":\"subject\",\"tag_id\":\"17733519562519782\",\"type\":\"organization\"}],\"evidence\":\"paraphrase\",\"featured\":false,\"key_point_index\":null,\"quote\":null,\"signal\":\"Audit software supply chain and application deployment processes.\",\"source_urls\":[],\"supporting_quotes\":[]}", "text": "Siemens recommends only building and running applications from trusted sources." } ], "entities": [], "headline": "Siemens SIPLUS and SIMATIC Products Vulnerable to \"Copy Fail\" (CVE-2026-31431)", "home_domain": null, "manifest_id": "1790100990136151262", "published_at": "2026-09-22", "significance": "high", "source_channel": "Cisa Cybersecurity Advisories Rss", "source_name": "cisa-cybersecurity-advisories-rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-04", "stream_id": null, "stream_ids": [ "17899764225996764" ], "summary": "Siemens has identified a 'Copy Fail' vulnerability (CVE-2026-31431) affecting numerous SIPLUS and SIMATIC industrial products. The flaw, rooted in the Linux kernel's algif_aead implementation, carries a CVSS score of 7.8. Siemens recommends updating to the latest versions, specifically V21 Update 2 SR1 or later for most affected units.", "tags": [ "Siemens", "Cybersecurity Incident" ] } ], "stories_per_domain": 24, "story_attempt": 1, "story_slot": 19, "story_units": [ { "paragraphs": [ { "citations": [ { "claim_id": "1790101288780719536", "kind": "claim", "manifest_id": "1790100990136889009" }, { "claim_id": "1790101288791092839", "kind": "claim", "manifest_id": "1790100990136889009" }, { "claim_id": "1790101288804947125", "kind": "claim", "manifest_id": "1790100990136889009" } ], "text": "Siemens Siveillance Control and Siveillance Control Pro systems contain a vulnerability in their Open Interface Services web module that allows attackers to upload arbitrary files. Exploiting this flaw can lead to unauthorized root-level access on the server." }, { "citations": [ { "claim_id": "1790101288820806514", "kind": "claim", "manifest_id": "1790100990136889009" }, { "claim_id": "1790101288823492626", "kind": "claim", "manifest_id": "1790100990136889009" }, { "claim_id": "1790101288825976574", "kind": "claim", "manifest_id": "1790100990136889009" }, { "claim_id": "1790101288827719541", "kind": "claim", "manifest_id": "1790100990136889009" }, { "claim_id": "1790101288834916363", "kind": "claim", "manifest_id": "1790100990136889009" } ], "text": "The vulnerability, tracked as CVE-2026-50093, is classified as CWE-434 for unrestricted file uploads and carries a CVSS 3.1 base score of 9.0. It affects Siveillance Control Pro V3.0 versions before 3.0.12.2173 and V4.0 versions before 4.0.9.2178. CISA recommends minimizing network exposure for all control system devices to mitigate risks." }, { "citations": [ { "claim_id": "1790101289482838295", "kind": "claim", "manifest_id": "1790100990136151262" }, { "claim_id": "1790101289484908242", "kind": "claim", "manifest_id": "1790100990136151262" }, { "claim_id": "1790101289491295145", "kind": "claim", "manifest_id": "1790100990136151262" }, { "claim_id": "1790101289487741276", "kind": "claim", "manifest_id": "1790100990136151262" }, { "claim_id": "1790101289493771482", "kind": "claim", "manifest_id": "1790100990136151262" } ], "text": "Separately, multiple Siemens SIPLUS and SIMATIC products are vulnerable to a \"Copy Fail\" flaw tracked as CVE-2026-31431. This vulnerability originates in the algif_aead implementation of the Linux kernel and has a CVSS v3.1 base score of 7.8. Siemens recommends updating affected products to V21 Update 2 SR1 or later." } ], "single_source": false, "title": "Siemens Siveillance and SIMATIC Systems Face Security Flaws" }, { "paragraphs": [ { "citations": [ { "claim_id": "1790104474448273502", "kind": "claim", "manifest_id": "1790100990136512200" }, { "claim_id": "1790104474455456103", "kind": "claim", "manifest_id": "1790100990136512200" }, { "claim_id": "1790104474453637848", "kind": "claim", "manifest_id": "1790100990136512200" } ], "text": "The lwIP TCP/IP Stack MQTT Client Application has an out-of-bounds write vulnerability tracked as CVE-2026-87121. The flaw carries a CVSS v3.1 base score of 9.8 and affects versions from 2.0.1 to 2.2.1." }, { "citations": [ { "claim_id": "1790104474451377965", "kind": "claim", "manifest_id": "1790100990136512200" }, { "claim_id": "1790104474458733008", "kind": "claim", "manifest_id": "1790100990136512200" } ], "text": "CISA notes that \"Successful exploitation of this vulnerability could allow an attacker to gain full code execution\" on the device. A fix is available in the official lwIP repository under commit f89407ea711879c04d91c92b35d67be78bbaf0f1." } ], "single_source": true, "title": "lwIP TCP/IP Stack Vulnerability Enables Code Execution" } ], "summary": "New security patches address critical vulnerabilities in Siemens Siveillance systems and the lwIP TCP/IP stack that could allow unauthorized root access or remote code execution.", "supply": { "briefs": 221, "manifests": 225, "mcp_servable": 155, "signals": 221 }, "supporting_evidence": [ { "home_domain": "society-law-government", "manifest_id": "1790100990136889009", "relevance_reasons": [ "high_text_similarity", "same_source_host", "shared_stream", "shared_topics", "specific_token_overlap" ], "score": 13.982353, "shared_tokens": [ "2026", "cisa", "cve", "cybersecurity", "vulnerability" ], "stream_ids": [ "17899764225996764" ] }, { "home_domain": "society-law-government", "manifest_id": "1790100990136151262", "relevance_reasons": [ "same_source_host", "shared_stream" ], "score": 8.509091, "shared_tokens": [ "2026", "cve", "cybersecurity" ], "stream_ids": [ "17899764225996764" ] } ], "supporting_home_domains": [ "society-law-government" ], "supporting_manifest_ids": [ "1790100990136151262", "1790100990136889009" ], "supporting_stream_ids": [ "17899764225996764" ], "tail": [], "title": "Siemens and lwIP Address Critical Infrastructure Security Vulnerabilities", "window": { "hours": 12, "since": "2026-09-22T13:37:32.821807+00:00", "until": "2026-09-23T01:37:32.821807+00:00" } }, "canonical_story_id": "2811afbfae2c34f7", "citation_ledger": { "assignment": { "assignment_desk_version": "v2", "assignment_rank": 19, "canonical_story_id": "hc_b84bccd82459666f4acce278", "canonical_url": "/news/story/hc_b84bccd82459666f4acce278/", "cluster_manifest_ids": [ "1790100990136512200" ], "cluster_signature": "hcsig_v1_7cc71e1c700b54c7c7e54ba27894633df3c1cef4e2981bc1c70951d78cb8d5ab", "cluster_stream_ids": [ "17899764225996764" ], "cross_domain_evidence": false, "dedupe_reason": "global prewrite assignment", "evidence_manifest_ids": [ "1790100990136151262", "1790100990136512200", "1790100990136889009" ], "evidence_stream_ids": [ "17899764225996764" ], "newsworthiness_score": { "audience_fit": 0.55, "breadth": 0.345833, "domain_priority": 0.96, "materiality": 0.9, "novelty": 1.0, "source_strength": 0.85, "total": 0.77325 }, "primary_home_domain": "society-law-government", "secondary_home_domains": [], "supporting_evidence": [ { "home_domain": "society-law-government", "manifest_id": "1790100990136889009", "relevance_reasons": [ "high_text_similarity", "same_source_host", "shared_stream", "shared_topics", "specific_token_overlap" ], "score": 13.982353, "shared_tokens": [ "2026", "cisa", "cve", "cybersecurity", "vulnerability" ], "stream_ids": [ "17899764225996764" ] }, { "home_domain": "society-law-government", "manifest_id": "1790100990136151262", "relevance_reasons": [ "same_source_host", "shared_stream" ], "score": 8.509091, "shared_tokens": [ "2026", "cve", "cybersecurity" ], "stream_ids": [ "17899764225996764" ] } ], "supporting_home_domains": [ "society-law-government" ], "supporting_manifest_ids": [ "1790100990136151262", "1790100990136889009" ], "supporting_stream_ids": [ "17899764225996764" ] }, "assignment_prefetch_billed_manifests": 43, "calls": [ { "billed_manifests": 0, "called_at": "2026-09-23T01:38:27.471291+00:00", "elapsed_ms": 224.22, "manifest_ids": [], "mode": "count", "payload_bytes": 889731, "tool": "synorb-manifests" }, { "billed_manifests": 0, "called_at": "2026-09-23T01:38:27.610081+00:00", "elapsed_ms": 134.58, "manifest_ids": [], "mode": "count", "payload_bytes": 294654, "tool": "synorb-manifests" }, { "billed_manifests": 0, "called_at": "2026-09-23T01:38:27.696473+00:00", "elapsed_ms": 86.18, "manifest_ids": [], "mode": "count", "payload_bytes": 6472, "tool": "synorb-manifests" }, { "billed_manifests": 0, "called_at": "2026-09-23T01:38:27.782909+00:00", "elapsed_ms": 84.13, "manifest_ids": [], "mode": "count", "payload_bytes": 79742, "tool": "synorb-manifests" }, { "billed_manifests": 14, "called_at": "2026-09-23T01:38:27.957806+00:00", "elapsed_ms": 168.15, "manifest_ids": [ "1790122674434817857", "1790122674434746777", "1790122674434589374", "1790122674434541356", "1790122674434529836", "1790122674434400918", "1790122674434299810", "1790122674434164101", "1790122674434102329", "1790122674434056110", "1790122674434035546", "1790122674434033422", "1790122674434032822", "1790122674431991800" ], "mode": "default", "payload_bytes": 522071, "tool": "synorb-manifests" }, { "billed_manifests": 0, "called_at": "2026-09-23T01:38:28.036573+00:00", "elapsed_ms": 78.01, "manifest_ids": [], "mode": "default", "payload_bytes": 6109, "tool": "synorb-manifests" }, { "billed_manifests": 0, "called_at": "2026-09-23T01:38:28.120605+00:00", "elapsed_ms": 81.6, "manifest_ids": [], "mode": "default", "payload_bytes": 77893, "tool": "synorb-manifests" }, { "billed_manifests": 29, "called_at": "2026-09-23T01:38:28.555083+00:00", "elapsed_ms": 411.78, "manifest_ids": [ "1790124939650320562", "1790122674434817857", "1790122674434746777", "1790122674434589374", "1790122674434541356", "1790122674434529836", "1790122674434400918", "1790122674434299810", "1790122674434164101", "1790122674434035546", "1790122674434032822", "1790122674431991800", "1790118820149663276", "1790116943159587221", "1790115715228899720", "1790115696962622042", "1790115215813444194", "1790115171091849129", "1790115062879782736", "1790108961421424686", "1790102746446414492", "1790102146265532502", "1790100990136889009", "1790100990136512200", "1790100990136452882", "1790100990136340757", "1790100990136151262", "1790100990136064250", "1790099592970024790", "1790099261515005119", "1790098357089506506", "1790098351451761449", "1790098308416148604", "1790095556433278955", "1790094532674311782", "1790093713273826225", "1790093713273028546", "1790093462366550094", "1790092787920201788", "1790089571127538215" ], "mode": "default", "payload_bytes": 1735008, "tool": "synorb-manifests" } ], "distinct_manifest_ids": [ "1790100990136151262", "1790100990136512200", "1790100990136889009" ], "edition_slot": "00", "excluded_manifest_ids": [], "prompt_version": "news_editorial_v2", "run_started_at": "2026-09-23T01:38:27.213788+00:00", "stories_per_domain": 24, "story_slot": 19, "strict_window": { "client_filtered": true, "published_date_from": "2026-09-22T13:37:32.821807+00:00", "published_date_to": "2026-09-23T01:37:32.821807+00:00" }, "total_billed_manifests": 3, "total_calls": 8, "total_payload_bytes": 3611680 }, "cluster_manifest_ids": [ "1790100990136512200", "1790100990136889009", "1790100990136151262" ], "cluster_signature": "title:siemens and lwip address critical infrastructure security vulnerabilities", "corrections": [], "dedupe_reason": "canonical public story", "edition_date": "2026-09-23", "fact_claim_map": [ { "claims": [ { "claim_id": "1790101288780719536", "claim_ref": "5bc31abe2386dd26304ce69baade08bb673ae657", "claim_text": "Siemens Siveillance Control and Siveillance Control Pro are affected by a vulnerability in the OIS web module.", "kind": "claim", "manifest_headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136889009&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 1, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03" }, { "claim_id": "1790101288791092839", "claim_ref": "bff7926b8d621597e94bbf0b0ae7132537b050b6", "claim_text": "The vulnerability (CVE-2026-50093) allows an attacker to upload arbitrary files to the server.", "kind": "claim", "manifest_headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136889009&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 2, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03" }, { "claim_id": "1790101288804947125", "claim_ref": "213be3169662e49081a4ee469058dd9dcfbc404a", "claim_text": "Exploitation of CVE-2026-50093 can lead to unauthorized root-level access on the OIS server.", "kind": "claim", "manifest_headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136889009&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 3, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03" } ], "paragraph": 1, "text": "Siemens Siveillance Control and Siveillance Control Pro systems contain a vulnerability in their Open Interface Services web module that allows attackers to upload arbitrary files. Exploiting this flaw can lead to unauthorized root-level access on the server." }, { "claims": [ { "claim_id": "1790101288820806514", "claim_ref": "087ed87793b6b71099b0fb38568abdfa9ec26325", "claim_text": "The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type.", "kind": "claim", "manifest_headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136889009&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 4, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03" }, { "claim_id": "1790101288823492626", "claim_ref": "e499371faed6f66aaf2f7e29a78e3e2ebd7d4761", "claim_text": "The CVSS 3.1 base score for this vulnerability is 9.0 (Critical).", "kind": "claim", "manifest_headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136889009&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 5, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03" }, { "claim_id": "1790101288825976574", "claim_ref": "cf1a42f0ca65f21ac6c7e17e6f7023f59f6b135d", "claim_text": "Siveillance Control Pro V3.0 versions before 3.0.12.2173 are affected.", "kind": "claim", "manifest_headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136889009&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 6, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03" }, { "claim_id": "1790101288827719541", "claim_ref": "97080cb774d1117e1fe8ae05c34f8bfcec72afc6", "claim_text": "Siveillance Control Pro V4.0 versions before 4.0.9.2178 are affected.", "kind": "claim", "manifest_headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136889009&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 7, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03" }, { "claim_id": "1790101288834916363", "claim_ref": "5d84402a4a9a6845a3d262508c5de79c94e7e708", "claim_text": "CISA recommends minimizing network exposure for all control system devices.", "kind": "claim", "manifest_headline": "Siemens Siveillance Control Vulnerability (CVE-2026-50093)", "manifest_id": "1790100990136889009", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136889009&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 8, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-03" } ], "paragraph": 2, "text": "The vulnerability, tracked as CVE-2026-50093, is classified as CWE-434 for unrestricted file uploads and carries a CVSS 3.1 base score of 9.0. It affects Siveillance Control Pro V3.0 versions before 3.0.12.2173 and V4.0 versions before 4.0.9.2178. CISA recommends minimizing network exposure for all control system devices to mitigate risks." }, { "claims": [ { "claim_id": "1790101289482838295", "claim_ref": "862b54042941d35086529d7cd62701efe74511b8", "claim_text": "Multiple Siemens SIPLUS and SIMATIC products are vulnerable to the 'Copy Fail' vulnerability.", "kind": "claim", "manifest_headline": "Siemens SIPLUS and SIMATIC Products Vulnerable to \"Copy Fail\" (CVE-2026-31431)", "manifest_id": "1790100990136151262", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136151262&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 9, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-04" }, { "claim_id": "1790101289484908242", "claim_ref": "ab7baa0a80d4e2dc127d89edd9d5ab383042f593", "claim_text": "The 'Copy Fail' vulnerability is identified as CVE-2026-31431.", "kind": "claim", "manifest_headline": "Siemens SIPLUS and SIMATIC Products Vulnerable to \"Copy Fail\" (CVE-2026-31431)", "manifest_id": "1790100990136151262", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136151262&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 10, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-04" }, { "claim_id": "1790101289491295145", "claim_ref": "9b60b471ddd5e45001b16147568bf6bc85d3a266", "claim_text": "The vulnerability originates in the Linux kernel's algif_aead implementation.", "kind": "claim", "manifest_headline": "Siemens SIPLUS and SIMATIC Products Vulnerable to \"Copy Fail\" (CVE-2026-31431)", "manifest_id": "1790100990136151262", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136151262&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 11, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-04" }, { "claim_id": "1790101289487741276", "claim_ref": "3852d370721e35027a6848e58e97c65083c7e895", "claim_text": "The vulnerability has a CVSS v3.1 base score of 7.8.", "kind": "claim", "manifest_headline": "Siemens SIPLUS and SIMATIC Products Vulnerable to \"Copy Fail\" (CVE-2026-31431)", "manifest_id": "1790100990136151262", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136151262&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 12, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-04" }, { "claim_id": "1790101289493771482", "claim_ref": "b7f8c2f0ad837b0d9a96b9035fda391843e562c5", "claim_text": "Siemens recommends updating affected products to V21 Update 2 SR1 or later.", "kind": "claim", "manifest_headline": "Siemens SIPLUS and SIMATIC Products Vulnerable to \"Copy Fail\" (CVE-2026-31431)", "manifest_id": "1790100990136151262", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136151262&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 13, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-04" } ], "paragraph": 3, "text": "Separately, multiple Siemens SIPLUS and SIMATIC products are vulnerable to a \"Copy Fail\" flaw tracked as CVE-2026-31431. This vulnerability originates in the algif_aead implementation of the Linux kernel and has a CVSS v3.1 base score of 7.8. Siemens recommends updating affected products to V21 Update 2 SR1 or later." }, { "claims": [ { "claim_id": "1790104474448273502", "claim_ref": "bd2bb1bceff529f2546b0630dd883d4ea1b773c7", "claim_text": "The lwIP TCP/IP Stack MQTT Client Application is vulnerable to an out-of-bounds write.", "kind": "claim", "manifest_headline": "lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121)", "manifest_id": "1790100990136512200", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136512200&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 14, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-01" }, { "claim_id": "1790104474455456103", "claim_ref": "9582f155006927bf0125d06fb91d45a28e0eff19", "claim_text": "The CVSS v3.1 base score for CVE-2026-87121 is 9.8.", "kind": "claim", "manifest_headline": "lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121)", "manifest_id": "1790100990136512200", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136512200&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 15, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-01" }, { "claim_id": "1790104474453637848", "claim_ref": "6fa90407076549841ff4b3536cec65add3008a03", "claim_text": "Versions of lwIP TCP/IP Stack MQTT Client Application from 2.0.1 to 2.2.1 are affected by CVE-2026-87121.", "kind": "claim", "manifest_headline": "lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121)", "manifest_id": "1790100990136512200", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136512200&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 16, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-01" } ], "paragraph": 4, "text": "The lwIP TCP/IP Stack MQTT Client Application has an out-of-bounds write vulnerability tracked as CVE-2026-87121. The flaw carries a CVSS v3.1 base score of 9.8 and affects versions from 2.0.1 to 2.2.1." }, { "claims": [ { "claim_id": "1790104474451377965", "claim_ref": "e915b3723a921fc3e9ccf6aad9fc04253783f000", "claim_text": "Successful exploitation of CVE-2026-87121 allows an attacker to gain full code execution on the device.", "kind": "claim", "manifest_headline": "lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121)", "manifest_id": "1790100990136512200", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136512200&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 17, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-01" }, { "claim_id": "1790104474458733008", "claim_ref": "32739b3b30ba036a7c81941c0cb132dfad220c39", "claim_text": "The fix for CVE-2026-87121 is contained in commit identifier f89407ea711879c04d91c92b35d67be78bbaf0f1.", "kind": "claim", "manifest_headline": "lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121)", "manifest_id": "1790100990136512200", "mcp_url": "https://synorb.com/agents?manifest_id=1790100990136512200&utm_source=hangingcontext&utm_medium=news_citation&utm_campaign=hc_news_public", "number": 18, "source_name": "Cisa Cybersecurity Advisories Rss", "source_url": "https://cisa.gov/news-events/ics-advisories/icsa-26-265-01" } ], "paragraph": 5, "text": "CISA notes that \"Successful exploitation of this vulnerability could allow an attacker to gain full code execution\" on the device. A fix is available in the official lwIP repository under commit f89407ea711879c04d91c92b35d67be78bbaf0f1." } ], "gate_report": { "checked_at": "2026-09-23T01:37:32.821807+00:00", "deterministic_pass": true, "findings": [], "initial_findings": [ { "code": "entailment_fail", "message": "LLM entailment judge found unsupported factual prose", "severity": "block" } ], "initial_status": "blocked", "judge": { "cost_usd": 0.004352, "model": "gemini-3.1-flash-lite", "sentences": [ { "classification": "factual", "reason": "The cited claims confirm that CVE-2026-50093 allows unauthorized root-level access and CVE-2026-87121 allows full code execution.", "sentence": "Siemens and lwIP Address Critical Infrastructure Security Vulnerabilities New security patches address critical vulnerabilities in Siemens Siveillance systems and the lwIP TCP/IP stack that could allow unauthorized root access or remote code execution.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims state that Siveillance systems are affected by a vulnerability in the OIS web module that allows arbitrary file uploads.", "sentence": "Siemens Siveillance Control and Siveillance Control Pro systems contain a vulnerability in their Open Interface Services web module that allows attackers to upload arbitrary files.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims explicitly state that exploitation of CVE-2026-50093 can lead to unauthorized root-level access on the OIS server.", "sentence": "Exploiting this flaw can lead to unauthorized root-level access on the server.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims confirm the CVE identifier, CWE classification, and CVSS score.", "sentence": "The vulnerability, tracked as CVE-2026-50093, is classified as CWE-434 for unrestricted file uploads and carries a CVSS 3.1 base score of 9.0.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims list these specific version ranges as affected.", "sentence": "It affects Siveillance Control Pro V3.0 versions before 3.0.12.2173 and V4.0 versions before 4.0.9.2178.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims explicitly state that CISA recommends minimizing network exposure for all control system devices.", "sentence": "CISA recommends minimizing network exposure for all control system devices to mitigate risks.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims confirm the product lines affected and the CVE identifier for the 'Copy Fail' vulnerability.", "sentence": "Separately, multiple Siemens SIPLUS and SIMATIC products are vulnerable to a \"Copy Fail\" flaw tracked as CVE-2026-31431.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims confirm the origin of the vulnerability and its CVSS score.", "sentence": "This vulnerability originates in the algif_aead implementation of the Linux kernel and has a CVSS v3.1 base score of 7.8.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims confirm the recommended update version.", "sentence": "Siemens recommends updating affected products to V21 Update 2 SR1 or later.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims confirm the vulnerability type and CVE identifier.", "sentence": "The lwIP TCP/IP Stack MQTT Client Application has an out-of-bounds write vulnerability tracked as CVE-2026-87121.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims confirm the CVSS score and the affected version range.", "sentence": "The flaw carries a CVSS v3.1 base score of 9.8 and affects versions from 2.0.1 to 2.2.1.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims confirm that successful exploitation allows for full code execution.", "sentence": "CISA notes that \"Successful exploitation of this vulnerability could allow an attacker to gain full code execution\" on the device.", "verdict": "entailed" }, { "classification": "factual", "reason": "The cited claims confirm the commit identifier for the fix.", "sentence": "A fix is available in the official lwIP repository under commit f89407ea711879c04d91c92b35d67be78bbaf0f1.", "verdict": "entailed" } ], "status": "pass", "tokens_in": 2004, "tokens_out": 1152 }, "metrics": { "cited_manifests": 3, "claims_available": 24, "lead_checked": true, "paragraphs_checked": 5 }, "rewrite_attempted": true, "status": "passed", "version": "news_pr_d_v2" }, "home_domain": "society-law-government", "lastmod": "2026-09-23", "primary_home_domain": "society-law-government", "schema_version": 1, "secondary_home_domains": [], "status": "draft", "summary": "New security patches address critical vulnerabilities in Siemens Siveillance systems and the lwIP TCP/IP stack that could allow unauthorized root access or remote code execution.", "suppressed_duplicate_of": null, "title": "Siemens and lwIP Address Critical Infrastructure Security Vulnerabilities", "url": "https://hangingcontext.com/news/society-law-government/2026-09-23-00-19-siemens-lwip-infrastructure-vulnerabilities/" }