CVE-2021-37181

highpriority · track · 41EPSS 0.019 · 79 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.89% (79th) EPSS
CVSS 7.5 · high
Is it mine?
60 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · siemens_psirt

EPSS · scored 2026-10-28

A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedCerberus DMS V4.0siemens_psirt

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedCerberus DMS V4.1siemens_psirt

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedCerberus DMS V4.2siemens_psirt

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedCerberus DMS V5.0siemens_psirt

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • FixedDesigo CC Compact V4.0siemens_psirt

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC Compact V4.1siemens_psirt

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC Compact V4.2siemens_psirt

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC Compact V5.0siemens_psirt

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • FixedDesigo CC V4.0siemens_psirt

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC V4.1siemens_psirt

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC V4.2siemens_psirt

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC V5.0siemens_psirt

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • FixedCerberus DMS V4.0cisa_csaf_ot

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedCerberus DMS V4.1cisa_csaf_ot

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedCerberus DMS V4.2cisa_csaf_ot

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedCerberus DMS V5.0cisa_csaf_ot

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • FixedDesigo CC Compact V4.0cisa_csaf_ot

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC Compact V4.1cisa_csaf_ot

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC Compact V4.2cisa_csaf_ot

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC Compact V5.0cisa_csaf_ot

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • FixedDesigo CC V4.0cisa_csaf_ot

    Apply Patch 1520637

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC V4.1cisa_csaf_ot

    Apply Patch 1417968

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC V4.2cisa_csaf_ot

    Update to V4.2 QU1 and Apply Patch 1417967

    https://support.industry.siemens.com/cs/document/109801179/
  • FixedDesigo CC V5.0cisa_csaf_ot

    Update to V5.0 QU1 or later version

    https://support.industry.siemens.com/cs/document/109800951/
  • MitigationCerberus DMS V4.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.1siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.2siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V5.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.1siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.2siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V5.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.1siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.2siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V5.0siemens_psirt

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.1cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V4.2cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationCerberus DMS V5.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.1cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V4.2cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC Compact V5.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.1cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V4.2cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

  • MitigationDesigo CC V5.0cisa_csaf_ot

    If a patch or Quality Update is not feasible, and if the user can accept to stop the use of Windows App and IE XBAP Web Client, then disable the Web Application and Web Client from SMC. As a result, Windows App and IE XBAP Web Client will stop working and the vulnerability cannot be exploited anymore.

02

cvss

Technical severity, 0–10. One row per scoring source.

10.0
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–10

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 6
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502US
04

affected products (60)

Products and version ranges known to be affected.

showing 20 of 60
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • SSA-453715SSA-453715: Deserialization Vulnerability in CCOM Communication Component of Desigo CC Family2021-09-14csaf · siemens_psirtDE

    Desigo CC, Desigo CC Compact and Cerberus DMS that use CCOM communication component hosted in IIS contain a deserialisation vulnerability that could allow an unauthenticated attacker to perform remote code execution. Only those systems that use Windows App and/or IE XBAP Web Client are affected. Regular installed clients and the new HTML5 Flex Clients are not impacted by this vulnerability. Note that the risk of this vulnerability being exploited is particularly high for any Desigo CC system that is connected directly to the Internet. For systems not accessible directly from the Internet, an attacker would need to have access to the local network to exploit this vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-21-257-17Siemens Desigo CC Family2021-09-14icsa · cisa_csaf_otUS

    Desigo CC, Desigo CC Compact and Cerberus DMS that use CCOM communication component hosted in IIS contain a deserialisation vulnerability that could allow an unauthenticated attacker to perform remote code execution. Only those systems that use Windows App and/or IE XBAP Web Client are affected. Regular installed clients and the new HTML5 Flex Clients are not impacted by this vulnerability. Note that the risk of this vulnerability being exploited is particularly high for any Desigo CC system that is connected directly to the Internet. For systems not accessible directly from the Internet, an attacker would need to have access to the local network to exploit this vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otsiemens_psirtNVDCVE.orgMITRE
published 2021-09-14modified 2026-06-17
08

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan