CVE-2026-54798: Siemens SICAM 8 ICS Vulnerabilities — Detection and Remediation

---
title: Potential Siemens SICAM Debug Code Activity
id: 8a2b4c1d-9e3f-4a5b-b6c7-1d2e3f4a5b6c
status: experimental
description: Detects potential access to active debug interfaces on Siemens SICAM devices. Debug interfaces often utilize non-standard high ports or malformed protocol headers. This rule monitors for traffic to ICS subnets on suspicious ports.
references:
 - https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-05
author: Security Arsenal
date: 2026/04/08
tags:
 - attack.initial_access
 - attack.ics
logsource:
 category: network_connection
 product: windows
detection:
 selection:
  DestinationPort|between:
   - 50000
   - 60000
  DestinationIpAddress|cidr: '10.0.0.0/8' # Modify to match your OT ICS subnet
  Initiated: 'true'
 condition: selection
falsepositives:
 - Legitimate engineering workstation access
 - Authorized vulnerability scanning
level: high
---
title: Siemens SICAM Device Denial of Service Indicator
id: 9c3d5e2f-0f4g-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects potential DoS conditions or scanning attempts against Siemens SICAM devices by identifying a high volume of TCP Resets (RST) or connection failures to standard IEC 60870-5-104 ports (2404).
references:
 - https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-05
author: Security Arsenal
date: 2026/04/08
tags:
 - attack.impact
 - attack.ics
logsource:
 category: network_connection
 product: windows
detection:
 selection_port:
  DestinationPort: 2404
 selection_failure:
  ConnectionStatus|contains:
   - 'RST'
   - 'TIMEOUT'
 condition: all of selection_*
timeframe: 1m
falsepositives:
 - Network instability
 - Misconfigured device
level: medium

// Hunt for anomalies in IEC 104 traffic or connectivity loss to SICAM devices
// Requires CommonSecurityLog (Firewall/IDS) or Syslog data
let ICS_Subnets = dynamic(["192.168.10.0/24", "10.20.30.0/24"]); // Define your OT subnets
let TimeWindow = 1h;
CommonSecurityLog
| where TimeGenerated > ago(TimeWindow)
| where ipv4_is_in_range(DestinationIP, ICS_Subnets)
| where DeviceAction in ("Reset", "Blocked", "Drop") or DestinationPort == 2404
| summarize count() by SourceIP, DestinationIP, DestinationPort, DeviceAction
| where count_ > 100 // Threshold for potential flooding/scanning
| extend AlertMessage = "High volume of reset/drop actions detected on ICS protocols"

-- Hunt for instances of Siemens engineering tools connecting to SICAM devices
-- on the management workstation. This helps identify the "Who" and "When" of configuration changes.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "SICAM.*\.exe" 
   OR Name =~ "DIGSI.*\.exe"
   OR CommandLine =~ "\\\\192\\.168\\." OR CommandLine =~ "\\\\10\\." 
   -- Look for connections to private IP ranges typical of OT

<#
.SYNOPSIS
    Siemens SICAM 8 Vulnerability - Network Exposure Check
.DESCRIPTION
    Checks connectivity to defined Siemens SICAM IP ranges to detect if devices are responsive.
    Use with caution in production OT environments to avoid triggering latency.
#>

$TargetIPs = @("192.168.10.5", "192.168.10.6") # Replace with your SICAM Device IPs
$Port = 2404 # Standard IEC 60870-5-104 Port
$Timeout = 1000

Write-Host "[+] Starting SICAM 8 Connectivity Check for CVE-2026-54798..." -ForegroundColor Cyan

foreach ($IP in $TargetIPs) {
    try {
        $TcpClient = New-Object System.Net.Sockets.TcpClient
        $Connect = $TcpClient.BeginConnect($IP, $Port, $null, $null)
        $Wait = $Connect.AsyncWaitHandle.WaitOne($Timeout, $false)
        
        if ($Wait) {
            Write-Host "[!] Device at $IP :$Port is REACHABLE." -ForegroundColor Green
            # Recommend immediate patching if firmware version is unknown
        } else {
            Write-Host "[-] Device at $IP :$Port is UNREACHABLE (Possible DoS or Offline)." -ForegroundColor Red
        }
        $TcpClient.Close()
    } catch {
        Write-Host "[-] Error checking $IP : $_" -ForegroundColor Yellow
    }
}

Write-Host "[+] Check complete. If devices are reachable, verify firmware versions in the web interface."
Write-Host "[+] Target Version: CPCI85 >= 26.20, SICORE >= 26.20.0"