SSA-330084

csafDEsiemens_psirt

SSA-330084: Client Code Execution Vulnerability in Desigo CC Product Family

Advisory ansehen veröffentlicht 2026-09-08

A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential lateral movement within the organization.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2026-34223DEhigh8.2—
A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC fam…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (8)

  • MitigationDesigo CC ClickOnce Client V6

    Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.

  • MitigationDesigo CC ClickOnce Client V7

    Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.

  • MitigationDesigo CC Installed Client V6

    Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.

  • MitigationDesigo CC Installed Client V7

    Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.

  • Kein Fix verfügbarDesigo CC ClickOnce Client V6

    Currently no fix is available

  • Kein Fix verfügbarDesigo CC ClickOnce Client V7

    Currently no fix is available

  • Kein Fix verfügbarDesigo CC Installed Client V6

    Currently no fix is available

  • Kein Fix verfügbarDesigo CC Installed Client V7

    Currently no fix is available

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan