Siemens COMOS
COMOS before V10.5 is affected by two local code execution vulnerabilities in the integrated Open Design Alliance Drawings SDK. Siemens has released a new version for COMOS and recommends to update to the latest version.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-5180US | high7.8 | Exploit | ||
An issue was discovered in Open Design Alliance
Drawings SDK before 2024.12. A corrupted value of number
of sectors used by the Fat structure in a crafted DGN file leads to an
out-… | ||||
| CVE-2023-26495US | high7.8 | — | ||
An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage th… | ||||
references
External citations — patches, advisories, analysis.
- SSA-659443: Local Code Execution Vulnerabilities in COMOS Before V10.5 - CSAF Versionself
- SSA-659443: Local Code Execution Vulnerabilities in COMOS Before V10.5 - HTML Versionself
- ICS Advisory ICSA-24-228-08 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-228-08 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- MitigationCOMOS
CVE-2023-5180, CVE-2023-26495: Ensure all files imported into the affected product originate from a trusted source and are transmitted over secure channels
- MitigationCOMOS
CVE-2023-5180, CVE-2023-26495: Ensure all files imported into the affected product originate from a trusted source and are transmitted over secure channels
- FixedCOMOS
Update to V10.5 or later version
- FixedCOMOS
Update to V10.5 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan