Siemens Desigo
view advisory published 2025-05-13
Desigo CC deployments that use Installed Client are impacted by an information disclosure vulnerability which could result in information leak from the Desigo CC server. The other Desigo CC client options, Windows App Client and Flex Client, are not affected by this vulnerability. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-23815US | —OT elevated | — | ||
A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone), De… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-523418: Information Disclosure Vulnerability in Desigo CC - CSAF Versionself
- SSA-523418: Information Disclosure Vulnerability in Desigo CC - HTML Versionself
- ICS Advisory ICSA-25-135-04 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-25-135-04 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- MitigationDesigo CC
Restrict access to the server's event port (default: 4998/tcp)
- FixedDesigo CC
On the Desigo CC server, disable the support for Installed Clients
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan