Vulnetix
Try Vulnetix Request Demo
SSA-453715 PUBLISHED CVSS 10 CRITICAL

Desigo CC, Desigo CC Compact and Cerberus DMS that use CCOM communication component hosted in IIS contain a deserialisation vulnerability that could allow an unauthenticated attacker to perform remote code execution. Only those systems that use Windows App and/or IE XBAP Web Client are affected. Regular installed clients and the new HTML5 Flex Clients are not impacted by this vulnerability. Note that the risk of this vulnerability being exploited is particularly high for any Desigo CC system that is connected directly to the Internet. For systems not accessible directly from the Internet, an attacker would need to have access to the local network to exploit this vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.

Risk Scores

CVSS v3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected Products

VendorProductVersions
Desigo CC Compact V4.1
Cerberus DMS V4.0
Desigo CC V4.2
Cerberus DMS V4.1
Desigo CC V5.0
Cerberus DMS V5.0
Cerberus DMS V4.2
Desigo CC Compact V4.2
Desigo CC Compact V5.0
Desigo CC V4.1
Desigo CC V4.0
Desigo CC Compact V4.0

Timeline

References

Open in Interactive Console →