{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as \"Node2Shell\" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens products.\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-242944: Node2Shell Vulnerability in Siemens Industrial Products - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-242944.html"
      },
      {
        "category": "self",
        "summary": "SSA-242944: Node2Shell Vulnerability in Siemens Industrial Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-242944.json"
      }
    ],
    "title": "SSA-242944: Node2Shell Vulnerability in Siemens Industrial Products",
    "tracking": {
      "current_release_date": "2026-11-10T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-242944",
      "initial_release_date": "2026-11-10T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-11-10T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "COMOS Walkinside",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "COMOS Walkinside"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "gDAP (gPROMS Digital Application Platform)",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "gDAP (gPROMS Digital Application Platform)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Project Server Web Administration Tool",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Project Server Web Administration Tool"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/>=8.2.0.1|<8.2.0.5",
                "product": {
                  "name": "SIMATIC BRAUMAT >= V8.2 Update 1 < V8.2 Update 5",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC BRAUMAT"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC Profiling Tool",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Profiling Tool"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/>=8.2.0.1|<8.2.0.5",
                "product": {
                  "name": "SIMATIC SISTAR >= V8.2 Update 1 < V8.2 Update 5",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC SISTAR"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC WinCC Companion",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC Companion"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/<3.20.17.1",
                "product": {
                  "name": "SIMATIC WinCC OA V3.20 < V3.20 P17.1",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC OA V3.20"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC WinCC OA V3.21",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC OA V3.21"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC WinCC Runtime Professional",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC Runtime Professional"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC WinCC Unified for Industrial Edge",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC Unified for Industrial Edge"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC WinCC Unified PC Runtime",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC Unified PC Runtime"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC WinCC Unified SIQENCE",
                  "product_id": "13"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC Unified SIQENCE"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC WinCC V7/V8",
                  "product_id": "14"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC V7/V8"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "TIA Administrator",
                  "product_id": "15"
                }
              }
            ],
            "category": "product_name",
            "name": "TIA Administrator"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "User Management Component (UMC)",
                  "product_id": "16"
                }
              }
            ],
            "category": "product_name",
            "name": "User Management Component (UMC)"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-111497",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "2"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\r\n\r\n\r\n\r\n\r\n\r\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ],
        "known_not_affected": [
          "2"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required",
          "product_ids": [
            "1",
            "10",
            "11",
            "12",
            "13",
            "14",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required. If UMC authentication is enabled, block requests that use Brotli compression: in IIS Manager, select the Default Web Site, open \"Request Filtering\" > \"Rules\", click \"Add Filtering Rule\", enter Name \"CVE-2026-111497\", Scan Headers \"Content-Encoding\" and Deny Strings \"br\", then click OK.",
          "product_ids": [
            "15"
          ]
        },
        {
          "category": "mitigation",
          "details": "Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required. In IIS Manager, select the Default Web Site, open \"Request Filtering\" > \"Rules\", click \"Add Filtering Rule\", enter Name \"CVE-2026-111497\", Scan Headers \"Content-Encoding\" and Deny Strings \"br\", then click OK.",
          "product_ids": [
            "16"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "5"
          ]
        },
        {
          "category": "none_available",
          "details": "Currently no fix is available",
          "product_ids": [
            "1",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "3",
            "7",
            "9"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.20 P17.1 or later version",
          "product_ids": [
            "8"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/110007354/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V8.2 Update 5 or later version",
          "product_ids": [
            "4",
            "6"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109976926/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "not shipped as part of the product",
          "product_ids": [
            "2"
          ]
        }
      ],
      "title": "CVE-2026-111497"
    }
  ]
}