Full Report
A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential lateral movement within the organization.
Analysis Summary
# Vulnerability: Client Code Execution in Siemens Desigo CC
## CVE Details
- **CVE ID:** CVE-2026-34223
- **CVSS Score:** 8.2 (High) [v3.1] / 8.6 (High) [v4.0]
- **CWE:** CWE-94: Improper Control of Generation of Code ('Code Injection')
## Affected Systems
- **Products:**
- Desigo CC ClickOnce Client
- Desigo CC Installed Client
- **Versions:**
- All versions of V6 and V7 for the products listed above.
- **Configurations:** Systems utilizing user-defined graphics documents with embedded script capabilities.
## Vulnerability Description
The affected application is susceptible to Client Code Execution (CCE) due to insufficient input validation when processing scripts embedded within user-defined graphics documents. If an attacker crafts or modifies a graphics document to include malicious commands, the embedded script is executed by the client application instance when the document is opened. This allows the attacker to perform arbitrary file writes to the client's operating system.
## Exploitation
- **Status:** Not exploited (Reported via Michelin CERT; no mention of active exploitation in the wild).
- **Complexity:** Low (Requires the creation of a malicious document).
- **Attack Vector:** Local (Requires a user to open a malicious file; CVSS vector AV:L).
- **User Interaction:** Required (The user must display the compromised graphics document).
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
- **Scope:** Changed (The vulnerability allows for potential lateral movement within the organization and compromise of the underlying operating system).
## Remediation
### Patches
- **Desigo CC V8:** Vulnerability fixed (Vulnerable code not present).
- **Desigo CC V9:** Vulnerability fixed (Vulnerable code not present).
- **Note:** Currently, no patches are available for V6 and V7 ClickOnce or Installed Clients. Users are encouraged to upgrade to V8 or V9.
### Workarounds
- **Least Privilege:** Evaluate and restrict authorization policies for the Graphics application. Ensure only authorized users have access to configuration and document modification.
- **Flex Client Usage:** Desigo CC Flex Client (V6 and V7) is not affected by this vulnerability and can be used as an alternative.
- **General Security:** Protect network access to devices and follow Siemens' operational guidelines for Industrial Security.
## Detection
- **Indicators of Compromise:** Presence of unauthorized or suspicious user-defined graphics documents (.gdr or similar formats) containing embedded scripts.
- **Detection methods:** Audit user activity regarding the modification of graphics documents. Monitor for unexpected file system writes originating from Desigo CC client processes.
## References
- **Vendor Advisory:** [https://cert-portal.siemens.com/productcert/pdf/ssa-330084.pdf](https://cert-portal.siemens.com/productcert/pdf/ssa-330084.pdf)
- **Siemens ProductCERT:** [https://www.siemens.com/cert/advisories](https://www.siemens.com/cert/advisories)
- **Industrial Security Guidelines:** [https://www.siemens.com/cert/operational-guidelines-industrial-security](https://www.siemens.com/cert/operational-guidelines-industrial-security)