SSA-242944

Siemens Security Advisory by Siemens ProductCERT

SSA-242944: Node2Shell Vulnerability in Siemens Industrial Products

Publication Date:	2026-11-10
Last Update:	2026-11-10
Current Version:	V1.0
CVSS v3.1 Base Score:	9.8
CVSS v4.0 Base Score:	9.2

SUMMARY

On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens products.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fixes and recommends specific mitigations for products where fixes are not or not yet available.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
COMOS Walkinside All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
Project Server Web Administration Tool All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC BRAUMAT All versions >= V8.2 Update 1 < V8.2 Update 5 affected by CVE-2026-111497	Update to V8.2 Update 5 or later version https://support.industry.siemens.com/cs/ww/en/view/109976926/ Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC Profiling Tool All versions affected by CVE-2026-111497	Currently no fix is planned Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC SISTAR All versions >= V8.2 Update 1 < V8.2 Update 5 affected by CVE-2026-111497	Update to V8.2 Update 5 or later version https://support.industry.siemens.com/cs/ww/en/view/109976926/ Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC WinCC Companion All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC WinCC OA	Show more details
SIMATIC WinCC OA V3.20 All versions < V3.20 P17.1 affected by CVE-2026-111497	Update to V3.20 P17.1 or later version https://support.industry.siemens.com/cs/ww/en/view/110007354/
SIMATIC WinCC OA V3.21 All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC WinCC Runtime Professional All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC WinCC Unified for Industrial Edge All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC WinCC Unified PC Runtime All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC WinCC Unified SIQENCE All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
SIMATIC WinCC V7/V8 All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required
TIA Administrator All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required. If UMC authentication is enabled, block requests that use Brotli compression: in IIS Manager, select the Default Web Site, open "Request Filtering" > "Rules", click "Add Filtering Rule", enter Name "CVE-2026-111497", Scan Headers "Content-Encoding" and Deny Strings "br", then click OK.
User Management Component (UMC) All versions affected by CVE-2026-111497	Currently no fix is available Temporarily disable Brotli compression and decompression at the application or proxy layer if it is not strictly required. In IIS Manager, select the Default Web Site, open "Request Filtering" > "Rules", click "Add Filtering Rule", enter Name "CVE-2026-111497", Scan Headers "Content-Encoding" and Deny Strings "br", then click OK.

KNOWN NOT AFFECTED PRODUCTS

Un-/Collapse All

Known Not Affected Products	Reason
gDAP (gPROMS Digital Application Platform) All versions not affected by CVE-2026-111497	not shipped as part of the product (Component Not Present)

MITIGATIONS

Product-specific remediations or mitigations can be found in the section Known Affected Products.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

COMOS is a unified data platform for collaborative plant design, operation and management that supports collecting, processing, saving, and distributing of information throughout the entire plant lifecycle.

SIMATIC BRAUMAT / SISTAR are industry-specific control systems especially for the control and monitoring of recipe-controlled production processes such as in the food, beverages and tobacco industries as well as for comparable batch-oriented production processes.

SIMATIC WinCC is a supervisory control and data acquisition (SCADA) system.

SIMATIC WinCC Open Architecture (OA) is part of the SIMATIC HMI family. It is designed for use in applications requiring a high degree of customer-specific adaptability, large or complex applications and projects that impose specific system requirements or functions.

SIMATIC WinCC Runtime Professional is a visualization runtime platform used for operator control and monitoring of machines and plants.

TIA Administrator is a web-based framework that can incorporate different function modules for administrative tasks, as well as functions for managing SIMATIC software and licenses.

User Management Component (UMC) enables for plant-wide central maintenance of users with optional integration with Microsoft Active Directories.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

CVSS v3.1 Base Score	9.8
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	9.2
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-787: Out-of-bounds Write

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-11-10):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.