SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family
Desigo CC, Desigo CC Compact and Cerberus DMS that use CCOM communication component hosted in IIS contain a deserialisation vulnerability that could allow an unauthenticated attacker to perform remote code execution. Only those systems that use Windows App and/or IE XBAP Web Client are affected. Regular installed clients and the new HTML5 Flex Clients are not impacted by this vulnerability. Note that the risk of this vulnerability being exploited is particularly high for any Desigo CC system that is connected directly to the Internet. For systems not accessible directly from the Internet, an attacker would need to have access to the local network to exploit this vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-37181US | critical10.0 | — | ||
A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family - CSAF Versionself
- SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family - PDF Versionself
- SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family - TXT Versionself
Behebungen (24)
- MitigationCerberus DMS V4.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationCerberus DMS V4.1
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationCerberus DMS V4.2
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationCerberus DMS V5.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC Compact V4.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC Compact V4.1
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC Compact V4.2
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC Compact V5.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC V4.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC V4.1
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC V4.2
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- MitigationDesigo CC V5.0
If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.
- BehobenCerberus DMS V4.0
Apply Patch 1520637
https://support.industry.siemens.com/cs/document/109801179/ - BehobenCerberus DMS V4.1
Apply Patch 1417968
https://support.industry.siemens.com/cs/document/109801179/ - BehobenCerberus DMS V4.2
Update to V4.2 QU1 and Apply Patch 1417967
https://support.industry.siemens.com/cs/document/109801179/ - BehobenCerberus DMS V5.0
Update to V5.0 QU1 or later version
https://support.industry.siemens.com/cs/document/109800951/ - BehobenDesigo CC Compact V4.0
Apply Patch 1520637
https://support.industry.siemens.com/cs/document/109801179/ - BehobenDesigo CC Compact V4.1
Apply Patch 1417968
https://support.industry.siemens.com/cs/document/109801179/ - BehobenDesigo CC Compact V4.2
Update to V4.2 QU1 and Apply Patch 1417967
https://support.industry.siemens.com/cs/document/109801179/ - BehobenDesigo CC Compact V5.0
Update to V5.0 QU1 or later version
https://support.industry.siemens.com/cs/document/109800951/ - BehobenDesigo CC V4.0
Apply Patch 1520637
https://support.industry.siemens.com/cs/document/109801179/ - BehobenDesigo CC V4.1
Apply Patch 1417968
https://support.industry.siemens.com/cs/document/109801179/ - BehobenDesigo CC V4.2
Update to V4.2 QU1 and Apply Patch 1417967
https://support.industry.siemens.com/cs/document/109801179/ - BehobenDesigo CC V5.0
Update to V5.0 QU1 or later version
https://support.industry.siemens.com/cs/document/109800951/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan