Siemens Desigo CC family
A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential lateral movement within the organization.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-34223DE | high8.2 | — | ||
A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC fam… | ||||
references
External citations — patches, advisories, analysis.
- SSA-330084: Client Code Execution Vulnerability in Desigo CC Product Family - CSAF Versionself
- SSA-330084: Client Code Execution Vulnerability in Desigo CC Product Family - HTML Versionself
- ICS Advisory ICSA-26-265-05 JSONself
- ICS Advisory ICSA-26-265-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- MitigationDesigo CC family V6
Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- MitigationDesigo CC family V7
Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- No fix availableDesigo CC family V6
Currently no fix is available
- No fix availableDesigo CC family V7
Currently no fix is available
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan