SSA-330084

Siemens Security Advisory by Siemens ProductCERT

SSA-330084: Client Code Execution Vulnerability in Desigo CC Product Family

Publication Date:	2026-09-08
Last Update:	2026-09-08
Current Version:	V1.0
CVSS v3.1 Base Score:	8.2
CVSS v4.0 Base Score:	8.6

SUMMARY

A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential lateral movement within the organization.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
Desigo CC family	Show more details
Desigo CC ClickOnce Client V6 All versions affected by CVE-2026-34223	Currently no fix is available See further recommendations from section Mitigations
Desigo CC ClickOnce Client V7 All versions affected by CVE-2026-34223	Currently no fix is available See further recommendations from section Mitigations
Desigo CC Installed Client V6 All versions affected by CVE-2026-34223	Currently no fix is available See further recommendations from section Mitigations
Desigo CC Installed Client V7 All versions affected by CVE-2026-34223	Currently no fix is available See further recommendations from section Mitigations

KNOWN NOT AFFECTED PRODUCTS

Un-/Collapse All

Known Not Affected Products	Reason
Desigo CC family	Show more details
Desigo CC family V8 All versions not affected by CVE-2026-34223	The vulnerability has been fixed in this version (Vulnerable Code Not Present)
Desigo CC family V9 All versions not affected by CVE-2026-34223	The vulnerability has been fixed in this version (Vulnerable Code Not Present)
Desigo CC Flex Client V6 All versions not affected by CVE-2026-34223	The vulnerability does not exist in this version (Vulnerable Code Not Present)
Desigo CC Flex Client V7 All versions not affected by CVE-2026-34223	The vulnerability does not exist in this version (Vulnerable Code Not Present)

MITIGATIONS

Siemens has identified the following specific mitigations that customers can apply to reduce the risk:

Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.

Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

Desigo CC is the integrated building management platform for managing high-performing buildings. With its open design, it has been developed to create comfortable, safe and efficient facilities. It is easily scalable from simple single-discipline systems to fully integrated buildings.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2026-34223

The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded within user-defined graphics documents. Specifically, when the script within a graphics document is designed or modified by an attacker to include malicious commands. When a user opens a compromised graphics document, the embedded script is executed on the client application instance, allowing an attacker to write arbitrary files to the client's operating system. Successful exploitation requires an attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. This could lead to compromise of the client operating system and potential lateral movement within the organization.

CVSS v3.1 Base Score	8.2
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0 Base Score	8.6
CVSS v4.0 Vector	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE	CWE-94: Improper Control of Generation of Code ('Code Injection')

ACKNOWLEDGMENTS

Siemens thanks the following party for its efforts:

Michelin CERT for reporting the vulnerability

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2026-09-08):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.