Full Report
Desigo CC, Desigo CC Compact and Cerberus DMS that use CCOM communication component hosted in IIS contain a deserialisation vulnerability that could allow an unauthenticated attacker to perform remote code execution. Only those systems that use Windows App and/or IE XBAP Web Client are affected. Regular installed clients and the new HTML5 Flex Clients are not impacted by this vulnerability. Note that the risk of this vulnerability being exploited is particularly high for any Desigo CC system that is connected directly to the Internet. For systems not accessible directly from the Internet, an attacker would need to have access to the local network to exploit this vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Siemens Desigo CC and Cerberus DMS Insecure Deserialization
## CVE Details
- **CVE ID:** CVE-2021-27393 (Note: Based on Siemens advisory SSA-728618 related to this specific component)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-502: Deserialization of Untrusted Data
## Affected Systems
- **Products:**
- Siemens Desigo CC
- Siemens Desigo CC Compact
- Siemens Cerberus DMS
- **Versions:** All versions prior to those listed in the Remediation section.
- **Configurations:** Systems using the **CCOM communication component hosted in IIS**. The vulnerability specifically impacts environments utilizing:
- Windows App (Web Client)
- IE XBAP (Internet Explorer XAML Browser Application) Web Client
- *Note: Regular installed clients and the new HTML5 Flex Clients are NOT impacted.*
## Vulnerability Description
The vulnerability exists within the CCOM (Common Communication Object Model) component when hosted in Internet Information Services (IIS). The component fails to properly validate or sanitize serialized data provided by a user. An unauthenticated attacker can send a specially crafted serialized object to the IIS server, which, upon being processed (deserialized), results in the execution of arbitrary code in the context of the IIS service.
## Exploitation
- **Status:** Vulnerability confirmed by vendor. (Check Siemens ProductCERT for latest "in the wild" status; typically categorized as "PoC known/possible").
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **Authentication:** None required (Unauthenticated)
## Impact
- **Confidentiality:** High (Total compromise of system data)
- **Integrity:** High (Modification of system files and configuration)
- **Availability:** High (Total system shutdown or disruption of building management services)
## Remediation
### Patches
Siemens recommends updating affected products to the following versions or later:
- **Desigo CC V4.x/V5.x:** Update to V5.0 or latest available patch/Hotfix.
- **Cerberus DMS V4.x/V5.x:** Update to V5.0 or latest available patch/Hotfix.
- *Refer to the Siemens ProductCERT portal for specific version-mapping updates.*
### Workarounds
- **Disable Web Clients:** If Windows App and IE XBAP clients are not required, disable the CCOM component in IIS.
- **Network Segmentation:** Ensure the Desigo CC/Cerberus DMS system is not directly accessible from the Internet.
- **Access Control:** Restrict access to the IIS hosted ports (typically 80/443) to known, trusted internal IP addresses only.
- **Migration:** Transition users to the **HTML5 Flex Client**, which is not susceptible to this flaw.
## Detection
- **Indicators of compromise:** Monitor IIS logs for unusual POST requests to CCOM-related endpoints originating from unknown IP addresses.
- **Detection methods and tools:**
- Review Windows Event Logs for unexpected processes spawned by the IIS Worker Process (`w3wp.exe`).
- Use network traffic analysis to detect large or anomalous serialized binary objects directed at the management server.
## References
- **Vendor Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-728618[.]pdf
- **Siemens ProductCERT:** hxxps[://]www[.]siemens[.]com/cert
- **CISA Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-21-131-05