CVE-2026-34223
highPriorität · verfolgen · 33EPSS 0.002 · 9. PerzentilDENLUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded within user-defined graphics documents. Specifically, when the script within a graphics document is designed or modified by an attacker to include malicious commands. When a user opens a compromised graphics document, the embedded script is executed on the client application instance, allowing an attacker to write arbitrary files to the client's operating system. Successful exploitation requires an attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. This could lead to compromise of the client operating system and potential lateral movement within the organization.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationDesigo CC ClickOnce Client V6siemens_psirt
Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- MitigationDesigo CC ClickOnce Client V7siemens_psirt
Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- MitigationDesigo CC Installed Client V6siemens_psirt
Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- MitigationDesigo CC Installed Client V7siemens_psirt
Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- MitigationDesigo CC family V6cisa_csaf_ot
Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- MitigationDesigo CC family V7cisa_csaf_ot
Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- Kein Fix verfügbarDesigo CC ClickOnce Client V6siemens_psirt
Currently no fix is available
- Kein Fix verfügbarDesigo CC ClickOnce Client V7siemens_psirt
Currently no fix is available
- Kein Fix verfügbarDesigo CC Installed Client V6siemens_psirt
Currently no fix is available
- Kein Fix verfügbarDesigo CC Installed Client V7siemens_psirt
Currently no fix is available
- Kein Fix verfügbarDesigo CC family V6cisa_csaf_ot
Currently no fix is available
- Kein Fix verfügbarDesigo CC family V7cisa_csaf_ot
Currently no fix is available
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.6–8.6
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (58)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2026-0346Kwetsbaarheden verholpen in Siemens productenNL2026-09-08csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance.
- SSA-330084SSA-330084: Client Code Execution Vulnerability in Desigo CC Product Family2026-09-08csaf · siemens_psirtDE
A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential lateral movement within the organization.
- ICSA-26-265-05Siemens Desigo CC family2026-09-08icsa · cisa_csaf_otUS
A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential lateral movement within the organization.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (1) nvd
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan