{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)", "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "summary", "text": "On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as \"Node2Shell\" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens software products.\n\nPlease also have a look on following Software Field Bulletins:\n\nTeamcenter: https://support.sw.siemens.com/en-US/knowledge-base/PL8869204\n\nPolarion: https://support.sw.siemens.com/en-US/knowledge-base/PL8869197\n\nManufacturing Operations Center (Opcenter) and Process Preparation X: https://support.sw.siemens.com/en-US/knowledge-base/PL8869211\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "productcert@siemens.com", "name": "Siemens ProductCERT", "namespace": "https://www.siemens.com" }, "references": [ { "category": "self", "summary": "SSA-678870: Node2Shell/Broccoli2Shell Vulnerabilities in Siemens Software Products - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-678870.html" }, { "category": "self", "summary": "SSA-678870: Node2Shell/Broccoli2Shell Vulnerabilities in Siemens Software Products - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-678870.json" } ], "title": "SSA-678870: Node2Shell/Broccoli2Shell Vulnerabilities in Siemens Software Products", "tracking": { "current_release_date": "2026-11-10T00:00:00.000Z", "generator": { "engine": { "name": "Siemens ProductCERT CSAF Generator", "version": "1" } }, "id": "SSA-678870", "initial_release_date": "2026-11-10T00:00:00.000Z", "revision_history": [ { "date": "2026-11-10T00:00:00.000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" } ], "status": "interim", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Calibre", "product_id": "1" } } ], "category": "product_name", "name": "Calibre" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Calibre ICE", "product_id": "2" } } ], "category": "product_name", "name": "Calibre ICE" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Capital", "product_id": "3" } } ], "category": "product_name", "name": "Capital" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Designcenter X Essentials", "product_id": "4" } } ], "category": "product_name", "name": "Designcenter X Essentials" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "HyperLynx", "product_id": "5" } } ], "category": "product_name", "name": "HyperLynx" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Innexis Architecture Native Acceleration 2026", "product_id": "6" } } ], "category": "product_name", "name": "Innexis Architecture Native Acceleration 2026" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Insights Hub", "product_id": "7" } } ], "category": "product_name", "name": "Insights Hub" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Connect Electronics", "product_id": "8" } } ], "category": "product_name", "name": "Opcenter Connect Electronics" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Connect MOM", "product_id": "9" } } ], "category": "product_name", "name": "Opcenter Connect MOM" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Execution Core", "product_id": "10" } } ], "category": "product_name", "name": "Opcenter Execution Core" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Execution Discrete", "product_id": "11" } } ], "category": "product_name", "name": "Opcenter Execution Discrete" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Execution Foundation", "product_id": "12" } } ], "category": "product_name", "name": "Opcenter Execution Foundation" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Execution Pharma", "product_id": "13" } } ], "category": "product_name", "name": "Opcenter Execution Pharma" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Execution Process", "product_id": "14" } } ], "category": "product_name", "name": "Opcenter Execution Process" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Intelligence", "product_id": "15" } } ], "category": "product_name", "name": "Opcenter Intelligence" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Intra Plant Logistics", "product_id": "16" } } ], "category": "product_name", "name": "Opcenter Intra Plant Logistics" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter Quality", "product_id": "17" } } ], "category": "product_name", "name": "Opcenter Quality" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter RDnL", "product_id": "18" } } ], "category": "product_name", "name": "Opcenter RDnL" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Opcenter X", "product_id": "19" } } ], "category": "product_name", "name": "Opcenter X" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "PADS Pro Essentials", "product_id": "20" } } ], "category": "product_name", "name": "PADS Pro Essentials" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "PADS Pro Student Edition", "product_id": "21" } } ], "category": "product_name", "name": "PADS Pro Student Edition" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "PADS Professional", "product_id": "22" } } ], "category": "product_name", "name": "PADS Professional" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Pathway to Learning Engineering", "product_id": "23" } } ], "category": "product_name", "name": "Pathway to Learning Engineering" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "PAVE360 Automotive 2026", "product_id": "24" } } ], "category": "product_name", "name": "PAVE360 Automotive 2026" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Polarion", "product_id": "25" } } ], "category": "product_name", "name": "Polarion" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Process Preparation X", "product_id": "26" } } ], "category": "product_name", "name": "Process Preparation X" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Simcenter Executable Digital Twin", "product_id": "27" } } ], "category": "product_name", "name": "Simcenter Executable Digital Twin" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Simcenter Studio", "product_id": "28" } } ], "category": "product_name", "name": "Simcenter Studio" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Solid Edge", "product_id": "29" } } ], "category": "product_name", "name": "Solid Edge" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Teamcenter Share", "product_id": "30" } } ], "category": "product_name", "name": "Teamcenter Share" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Teamcenter V2412", "product_id": "31" } } ], "category": "product_name", "name": "Teamcenter V2412" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Teamcenter V2506", "product_id": "32" } } ], "category": "product_name", "name": "Teamcenter V2506" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Teamcenter V2512", "product_id": "33" } } ], "category": "product_name", "name": "Teamcenter V2512" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Teamcenter V2606", "product_id": "34" } } ], "category": "product_name", "name": "Teamcenter V2606" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Xpedition Designer", "product_id": "35" } } ], "category": "product_name", "name": "Xpedition Designer" }, { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "Xpedition Enterprise", "product_id": "36" } } ], "category": "product_name", "name": "Xpedition Enterprise" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-111497", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "flags": [ { "label": "component_not_present", "product_ids": [ "30", "2", "1", "23", "4", "29", "3" ] }, { "label": "vulnerable_code_not_present", "product_ids": [ "25" ] } ], "notes": [ { "category": "description", "text": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\r\n\r\n\r\n\r\n\r\n\r\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "title": "CVE Description" } ], "product_status": { "known_affected": [ "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "24", "26", "27", "28", "31", "32", "33", "34", "35", "36", "5", "6", "7", "8", "9" ], "known_not_affected": [ "1", "2", "23", "25", "29", "3", "30", "4" ] }, "remediations": [ { "category": "mitigation", "details": "Disable brotli compression and block brotli compression at the network firewall.", "product_ids": [ "20", "21", "22", "35", "36", "5" ] }, { "category": "mitigation", "details": "For Teamcenter manual mitigation instructions can be found here: https://support.sw.siemens.com/en-US/knowledge-base/PL8869204", "product_ids": [ "31", "32", "33", "34" ] }, { "category": "mitigation", "details": "The vulnerability can be mitigated on the IIS Reverse Proxy. Please see https://support.sw.siemens.com/en-US/knowledge-base/PL8869211", "product_ids": [ "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "26", "8", "9" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "24", "26", "27", "28", "31", "32", "33", "34", "35", "36", "5", "6", "7", "8", "9" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "24", "26", "27", "28", "31", "32", "33", "34", "35", "36", "5", "6", "7", "8", "9" ] } ], "threats": [ { "category": "impact", "details": "Node.js is not present", "product_ids": [ "30", "2", "1", "23", "4", "29", "3" ] }, { "category": "impact", "details": "Polarion uses node.js 10.15.0 - Brotli was introduced to node.js in 10.16.0\r\n\r\n\r\nfurther information:\r\nhttps://support.sw.siemens.com/en-US/knowledge-base/PL8869197", "product_ids": [ "25" ] } ], "title": "CVE-2026-111497" } ] }