Hanging Context
Society, Law & Government 2026-09-23 00:00 UTC edition Story 19 of 24 Gate: passed

Siemens and lwIP Address Critical Infrastructure Security Vulnerabilities

New security patches address critical vulnerabilities in Siemens Siveillance systems and the lwIP TCP/IP stack that could allow unauthorized root access or remote code execution.

Status: draft - Built from Synorb manifests, source URLs, claim refs, and MCP-servable evidence.

Story BuildSociety, Law & Government
Manifests reviewed
225
Manifests cited
3
Claim refs
18
Agent-readable
155
Not decoration: this is the source-work behind the story, from collected manifests to cited claims.

Siemens Siveillance and SIMATIC Systems Face Security Flaws

Siemens Siveillance Control and Siveillance Control Pro systems contain a vulnerability in their Open Interface Services web module that allows attackers to upload arbitrary files. Exploiting this flaw can lead to unauthorized root-level access on the server.[1][2][3]

The vulnerability, tracked as CVE-2026-50093, is classified as CWE-434 for unrestricted file uploads and carries a CVSS 3.1 base score of 9.0. It affects Siveillance Control Pro V3.0 versions before 3.0.12.2173 and V4.0 versions before 4.0.9.2178. CISA recommends minimizing network exposure for all control system devices to mitigate risks.[4][5][6][7][8]

Separately, multiple Siemens SIPLUS and SIMATIC products are vulnerable to a "Copy Fail" flaw tracked as CVE-2026-31431. This vulnerability originates in the algif_aead implementation of the Linux kernel and has a CVSS v3.1 base score of 7.8. Siemens recommends updating affected products to V21 Update 2 SR1 or later.[9][10][11][12][13]

lwIP TCP/IP Stack Vulnerability Enables Code Execution

The lwIP TCP/IP Stack MQTT Client Application has an out-of-bounds write vulnerability tracked as CVE-2026-87121. The flaw carries a CVSS v3.1 base score of 9.8 and affects versions from 2.0.1 to 2.2.1.[14][15][16]

CISA notes that "Successful exploitation of this vulnerability could allow an attacker to gain full code execution" on the device. A fix is available in the official lwIP repository under commit f89407ea711879c04d91c92b35d67be78bbaf0f1.[17][18]

Key takeaways

  • The vulnerability (CVE-2026-87121) carries a CVSS v3.1 base score of 9.8, indicating a critical severity level. 1 source
  • Successful exploitation allows an attacker to gain full code execution on the target device without requiring authentication. 1 source
  • The fix is available via a specific commit (f89407ea711879c04d91c92b35d67be78bbaf0f1) in the official lwIP repository. 1 source
  • CISA recommends isolating control system networks behind firewalls and minimizing internet exposure to mitigate potential exploitation risks. 1 source
  • Update the lwIP TCP/IP Stack MQTT Client Application to a version containing the fix from the official repository. 1 source
  • Isolate control system networks and remote devices behind firewalls to prevent unauthorized internet access. 1 source

Notable quotes

“Successful exploitation of this vulnerability could allow an attacker to gain full code execution”

What’s unresolved

  • No reports of active exploitation in the wild have been confirmed by CISA at this time.

Citations

  1. [1] Siemens Siveillance Control Vulnerability (CVE-2026-50093) Siemens Siveillance Control and Siveillance Control Pro are affected by a vulnerability in the OIS web module. Manifest ID 1790100990136889009 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  2. [2] Siemens Siveillance Control Vulnerability (CVE-2026-50093) The vulnerability (CVE-2026-50093) allows an attacker to upload arbitrary files to the server. Manifest ID 1790100990136889009 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  3. [3] Siemens Siveillance Control Vulnerability (CVE-2026-50093) Exploitation of CVE-2026-50093 can lead to unauthorized root-level access on the OIS server. Manifest ID 1790100990136889009 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  4. [4] Siemens Siveillance Control Vulnerability (CVE-2026-50093) The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. Manifest ID 1790100990136889009 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  5. [5] Siemens Siveillance Control Vulnerability (CVE-2026-50093) The CVSS 3.1 base score for this vulnerability is 9.0 (Critical). Manifest ID 1790100990136889009 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  6. [6] Siemens Siveillance Control Vulnerability (CVE-2026-50093) Siveillance Control Pro V3.0 versions before 3.0.12.2173 are affected. Manifest ID 1790100990136889009 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  7. [7] Siemens Siveillance Control Vulnerability (CVE-2026-50093) Siveillance Control Pro V4.0 versions before 4.0.9.2178 are affected. Manifest ID 1790100990136889009 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  8. [8] Siemens Siveillance Control Vulnerability (CVE-2026-50093) CISA recommends minimizing network exposure for all control system devices. Manifest ID 1790100990136889009 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  9. [9] Siemens SIPLUS and SIMATIC Products Vulnerable to "Copy Fail" (CVE-2026-31431) Multiple Siemens SIPLUS and SIMATIC products are vulnerable to the 'Copy Fail' vulnerability. Manifest ID 1790100990136151262 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  10. [10] Siemens SIPLUS and SIMATIC Products Vulnerable to "Copy Fail" (CVE-2026-31431) The 'Copy Fail' vulnerability is identified as CVE-2026-31431. Manifest ID 1790100990136151262 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  11. [11] Siemens SIPLUS and SIMATIC Products Vulnerable to "Copy Fail" (CVE-2026-31431) The vulnerability originates in the Linux kernel's algif_aead implementation. Manifest ID 1790100990136151262 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  12. [12] Siemens SIPLUS and SIMATIC Products Vulnerable to "Copy Fail" (CVE-2026-31431) The vulnerability has a CVSS v3.1 base score of 7.8. Manifest ID 1790100990136151262 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  13. [13] Siemens SIPLUS and SIMATIC Products Vulnerable to "Copy Fail" (CVE-2026-31431) Siemens recommends updating affected products to V21 Update 2 SR1 or later. Manifest ID 1790100990136151262 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  14. [14] lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121) The lwIP TCP/IP Stack MQTT Client Application is vulnerable to an out-of-bounds write. Manifest ID 1790100990136512200 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  15. [15] lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121) The CVSS v3.1 base score for CVE-2026-87121 is 9.8. Manifest ID 1790100990136512200 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  16. [16] lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121) Versions of lwIP TCP/IP Stack MQTT Client Application from 2.0.1 to 2.2.1 are affected by CVE-2026-87121. Manifest ID 1790100990136512200 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  17. [17] lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121) Successful exploitation of CVE-2026-87121 allows an attacker to gain full code execution on the device. Manifest ID 1790100990136512200 - Cisa Cybersecurity Advisories Rss - interrogate via MCP
  18. [18] lwIP TCP/IP Stack MQTT Client Application Vulnerability (CVE-2026-87121) The fix for CVE-2026-87121 is contained in commit identifier f89407ea711879c04d91c92b35d67be78bbaf0f1. Manifest ID 1790100990136512200 - Cisa Cybersecurity Advisories Rss - interrogate via MCP