SSA-166980

Siemens Security Advisory by Siemens ProductCERT

SSA-166980: PHP2Shell Vulnerabilities in Siemens Products

Publication Date:	2026-10-26
Last Update:	2026-10-27
Current Version:	V1.1

SUMMARY

On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines, and to follow the recommendations in the product manuals.

Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available.

KNOWN NOT AFFECTED PRODUCTS

Un-/Collapse All

Known Not Affected Products	Reason
Building X All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Climatix Cloud IC All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Climatix Devices All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Connect X200 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Connect X300 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Connect X500 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
cRSP All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo CC All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo Optic All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo PXC4 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo PXC5 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Desigo PXC7 All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Navigator E&S All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Sinteso FS20 EN All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
SiPass integrated All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
SIPORT All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Siveillance Control All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Siveillance Control Pro All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Siveillance Intrusion All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)
Siveillance Video All versions not affected by all CVEs CVE-2026-109618 CVE-2026-109619	PHP is not present in this product (Component Not Present)

MITIGATIONS

Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.

Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity

PRODUCT DESCRIPTION

Desigo CC is the integrated building management platform for managing high-performing buildings. With its open design, it has been developed to create comfortable, safe and efficient facilities. It is easily scalable from simple single-discipline systems to fully integrated buildings.

Sinteso EN is a fire protection system consisting of fire panels, detection and management stations. It complies with the European standard EN 54 for fire detection and alarm systems.

SiPass integrated is a powerful and extremely flexible access control system.

SIPORT is a comprehensive, modular and reliable system for access control and time management within the Siveillance Access Suite.

Siveillance Control Pro is a command and control solution, specifically designed to support security management at critical infrastructure sites such as ports, airports, oil and gas power generation and distribution, chemical and pharma industries, heavy industries and campus environments.

Siveillance Control, formerly known as Siveillance Viewpoint, is a Physical Security Information Management system (PSIM) that seamlessly consolidates a variety of safety and security systems, such as access control, intrusion detection, and video surveillance, all on one common platform.

Siveillance Video (formerly called Siveillance VMS) is a powerful IP video management software designed for deployments ranging from small and simple to large-scale and high-security. The Siveillance Video portfolio consists of four versions, Siveillance Video Core, Core Plus, Advanced, and Pro, addressing the specific needs of small and medium size solutions up to large complex deployments.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	9.2
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-416: Use After Free

Vulnerability CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVSS v3.1 Base Score	8.1
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	9.2
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-416: Use After Free

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-10-26):	Publication Date
V1.1 (2026-10-27):	Updated the Known not affected list

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.