Siemens Desigo CC Family
Desigo CC, Desigo CC Compact and Cerberus DMS that use CCOM communication component hosted in IIS contain a deserialisation vulnerability that could allow an unauthenticated attacker to perform remote code execution. Only those systems that use Windows App and/or IE XBAP Web Client are affected. Regular installed clients and the new HTML5 Flex Clients are not impacted by this vulnerability. Note that the risk of this vulnerability being exploited is particularly high for any Desigo CC system that is connected directly to the Internet. For systems not accessible directly from the Internet, an attacker would need to have access to the local network to exploit this vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-37181US | critical10.0 | — | ||
A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0… | ||||
references
External citations — patches, advisories, analysis.
- SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family - CSAF Versionself
- SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family - PDF Versionself
- SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family - TXT Versionself
- ICS Advisory ICSA-21-257-17 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-257-17 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (24)
- MitigationCerberus DMS V4.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationCerberus DMS V4.1
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationCerberus DMS V4.2
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationCerberus DMS V5.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC Compact V4.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC Compact V4.1
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC Compact V4.2
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC Compact V5.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC V4.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC V4.1
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC V4.2
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC V5.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- FixedCerberus DMS V4.0
Apply Patch 1520637
https://support.industry.siemens.com/cs/document/109801179/ - FixedCerberus DMS V4.1
Apply Patch 1417968
https://support.industry.siemens.com/cs/document/109801179/ - FixedCerberus DMS V4.2
Update to V4.2 QU1 and Apply Patch 1417967
https://support.industry.siemens.com/cs/document/109801179/ - FixedCerberus DMS V5.0
Update to V5.0 QU1 or later version
https://support.industry.siemens.com/cs/document/109800951/ - FixedDesigo CC Compact V4.0
Apply Patch 1520637
https://support.industry.siemens.com/cs/document/109801179/ - FixedDesigo CC Compact V4.1
Apply Patch 1417968
https://support.industry.siemens.com/cs/document/109801179/ - FixedDesigo CC Compact V4.2
Update to V4.2 QU1 and Apply Patch 1417967
https://support.industry.siemens.com/cs/document/109801179/ - FixedDesigo CC Compact V5.0
Update to V5.0 QU1 or later version
https://support.industry.siemens.com/cs/document/109800951/ - FixedDesigo CC V4.0
Apply Patch 1520637
https://support.industry.siemens.com/cs/document/109801179/ - FixedDesigo CC V4.1
Apply Patch 1417968
https://support.industry.siemens.com/cs/document/109801179/ - FixedDesigo CC V4.2
Update to V4.2 QU1 and Apply Patch 1417967
https://support.industry.siemens.com/cs/document/109801179/ - FixedDesigo CC V5.0
Update to V5.0 QU1 or later version
https://support.industry.siemens.com/cs/document/109800951/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan