CVE-2021-37181

highPriorität · verfolgen · 41EPSS 0.019 · 79. PerzentilDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.89% (79th) EPSS
CVSS 7.5 · high
Is it mine?
60 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · siemens_psirt

EPSS · bewertet 2026-10-28

A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenCerberus DMS V4.0siemens_psirt

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenCerberus DMS V4.1siemens_psirt

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenCerberus DMS V4.2siemens_psirt

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenCerberus DMS V5.0siemens_psirt

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • BehobenDesigo CC Compact V4.0siemens_psirt

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC Compact V4.1siemens_psirt

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC Compact V4.2siemens_psirt

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC Compact V5.0siemens_psirt

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • BehobenDesigo CC V4.0siemens_psirt

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC V4.1siemens_psirt

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC V4.2siemens_psirt

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC V5.0siemens_psirt

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • BehobenCerberus DMS V4.0cisa_csaf_ot

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenCerberus DMS V4.1cisa_csaf_ot

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenCerberus DMS V4.2cisa_csaf_ot

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenCerberus DMS V5.0cisa_csaf_ot

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • BehobenDesigo CC Compact V4.0cisa_csaf_ot

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC Compact V4.1cisa_csaf_ot

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC Compact V4.2cisa_csaf_ot

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC Compact V5.0cisa_csaf_ot

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • BehobenDesigo CC V4.0cisa_csaf_ot

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC V4.1cisa_csaf_ot

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC V4.2cisa_csaf_ot

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • BehobenDesigo CC V5.0cisa_csaf_ot

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • MitigationCerberus DMS V4.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.1siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.2siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V5.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.1siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.2siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V5.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.1siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.2siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V5.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.1cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.2cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V5.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.1cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.2cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V5.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.1cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.2cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V5.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

10.0
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–10

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 6
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-502USCWE-502USCWE-502US
04

betroffene Produkte (60)

Betroffene Produkte und Versionsbereiche.

20 von 60 angezeigt
05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • SSA-453715SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family2021-09-14csaf · siemens_psirtDE

    Desigo CC, Desigo CC Compact and Cerberus DMS that use CCOM communication component hosted in IIS contain a deserialisation vulnerability that could allow an unauthenticated attacker to perform remote code execution. Only those systems that use Windows App and/or IE XBAP Web Client are affected. Regular installed clients and the new HTML5 Flex Clients are not impacted by this vulnerability. Note that the risk of this vulnerability being exploited is particularly high for any Desigo CC system that is connected directly to the Internet. For systems not accessible directly from the Internet, an attacker would need to have access to the local network to exploit this vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-21-257-17Siemens Desigo CC Family2021-09-14icsa · cisa_csaf_otUS

    Desigo CC, Desigo CC Compact and Cerberus DMS that use CCOM communication component hosted in IIS contain a deserialisation vulnerability that could allow an unauthenticated attacker to perform remote code execution. Only those systems that use Windows App and/or IE XBAP Web Client are affected. Regular installed clients and the new HTML5 Flex Clients are not impacted by this vulnerability. Note that the risk of this vulnerability being exploited is particularly high for any Desigo CC system that is connected directly to the Internet. For systems not accessible directly from the Internet, an attacker would need to have access to the local network to exploit this vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2021-09-14geändert 2026-06-17
08

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan