ICSA-26-043-04

icsaUScisa_csaf_ot

Siemens Desigo CC Product Family and SENTRON Powermanager

Advisory ansehen veröffentlicht 2026-02-10

Versions V6.0 through V8 QU1 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON Powermanager, are affected by a vulnerability in the underlying third-party component WIBU Systems CodeMeter Runtime. Successful exploitation of this vulnerability could lead to code execution in the context of the current process. Siemens has released instructions how to update the CodeMeter Runtime component and recommends to apply the update on affected systems.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2023-38545UScritical9.8Exploit
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the ad…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (6)

  • BehobenDesigo CC family V6

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V7

    Apply patch as documented in section 'Additional Information'

  • BehobenDesigo CC family V8

    Update to V8.0 QU2 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109997962/
  • BehobenSENTRON Powermanager V6

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V7

    Apply patch as documented in section 'Additional Information'

  • BehobenSENTRON Powermanager V8

    Update to V8.0 QU2 or later version

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan