> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Siemens Desigo CC family
- URL: https://f4n6.co.uk/security-feed/siemens-desigo-cc-family/
- Published: 2026-09-22T18:18:59.000Z
- Updated: 2026-09-22T18:18:59.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Siemens has disclosed a Client Code Execution (CCE) vulnerability, CVE-2026-34223, affecting all versions of the Desigo CC building management station software in the V6 and V7 families. The flaw (CVSS v3.1 8.2, HIGH, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) lets an attacker embed malicious script in a user-defined graphics document; when a privileged user opens that document, the script runs in the client application and can write arbitrary files to the underlying operating system. No vendor fix exists. The advisory is a CISA republication of Siemens ProductCERT advisory SSA-330084, published by Siemens on 2026-09-08 and by CISA on 2026-09-22\. For EMEA financial services the exposure is limited to Desigo CC deployments in branch and campus facilities; the scope-changed vector means a compromised engineering client is a plausible bridge from the OT building network into the corporate estate. No CISA-KEV exploitation state is recorded for this CVE in the verified reference data, and none is claimed here.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The vulnerability is an unexploited, vendor-disclosed flaw in building management software with no fix yet available; the applicable obligations (patch management, ICT third-party risk) are generic to any vulnerability disclosure and do not turn on a fact distinctive to this advisory. Clients running Desigo CC should track it under their existing ICT risk processes, including DORA Art. 28 (ICT third-party risk, general principles) where the system is operated by a facilities-management provider, but no article-specific trigger arises from the source material.

## 3\. Technical analysis & attack chain

CVE-2026-34223 is a code injection flaw (CWE-94, Improper Control of Generation of Code) in the Desigo CC Graphics application. Desigo CC is Siemens' building management station; user-defined graphics documents are configuration artefacts that can contain embedded scripts, and the client executes those scripts when the document is displayed. The application performs insufficient input validation on script content embedded in these documents, so an attacker who can design or modify a graphics document can include arbitrary commands in it.

Confirmed attack chain, as described in the advisory:

1. The attacker crafts a graphics document, or modifies an existing one, so that its embedded script contains malicious commands.
2. The attacker delivers the document to a Desigo CC environment and entices a user with sufficient privileges to open or display it. The advisory does not specify a delivery mechanism; the vector is local (AV:L) with required user interaction (UI:R), so the document must reach a client workstation by some social-engineering or file-distribution route.
3. On display, the client application instance executes the embedded script without adequate validation.
4. Script execution allows the attacker to write arbitrary files to the client's operating system.
5. Siemens assesses that successful exploitation could compromise the client operating system and enable lateral movement within the organisation. The scope-changed vector (S:C) reflects that impact extends beyond the Desigo CC process itself.

Affected products are Desigo CC family V6 (all versions) and Desigo CC family V7 (all versions). Privileges required are low (PR:L): the victim must hold sufficient privileges in the Graphics application, which is why Siemens' mitigation targets the Graphics authorisation policy. No attacker attribution, exploit availability, or in-the-wild exploitation is claimed in the source. Michelin CERT reported the vulnerability to Siemens; that is the full extent of third-party involvement on record.

Two gaps matter for defenders. The advisory does not name the script language or file format of user-defined graphics documents, so content inspection rules cannot be written from this source alone. It also does not describe what the written files could be used for beyond OS compromise; the lateral-movement claim is vendor assessment language, not an observed technique. This advisory is single-sourced (Siemens SSA-330084 via CISA republication); no second vendor analysis exists to corroborate the mechanism.

## 4\. Mitigation & containment

No vendor fix is available, so controls are procedural and architectural.

**P1, within 24 hours:** Inventory Desigo CC V6 and V7 deployments across the estate, including systems operated by facilities-management contractors, and identify which workstations run the Graphics application. Restrict who can author or modify graphics documents: Siemens' stated mitigation is to evaluate the Graphics application authorisation policy on a least-privilege basis so only required users have configuration access. Review recently modified or newly imported graphics documents on engineering clients for unexpected script content.

**P2, within 72 hours:** Segment building management networks from the corporate LAN. CISA's recommended practices for this advisory are to minimise network exposure of control systems, keep them off the internet, place them behind firewalls isolated from business networks, and use VPN with current versions where remote access is required. Apply application control or ERDL allowlisting on Desigo CC engineering workstations to block arbitrary child-process and file-write behaviour originating from the Desigo CC client, which directly constrains the post-exploitation step regardless of document content.

**P3, within 7 days:** Establish a change-control gate for graphics documents entering Desigo CC environments, treating them as executable content rather than passive configuration. Track Siemens SSA-330084 (CSAF and HTML versions referenced in the advisory) for a fix release and plan deployment when available. Follow Siemens' operational guidelines for Industrial Security (https://www.siemens.com/cert/operational-guidelines-industrial-security) for the protected-environment configuration CISA endorses.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

## 6\. Detection

Insufficient indicators to author detection rules. The source describes the vulnerability mechanism but provides no file names, script strings, registry keys, or network signatures associated with exploitation. The absence of a documented script language or graphics-document format in the advisory prevents writing a content-based rule that would not be guesswork.

## 7\. Sources

- CISA, Siemens Desigo CC family, ICSA-26-265-05, https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-05, 2026-09-22 (republication of Siemens ProductCERT SSA-330084, original publication 2026-09-08)
- Siemens ProductCERT, operational guidelines for Industrial Security, https://www.siemens.com/cert/operational-guidelines-industrial-security, accessed 2026-09-22

## 8\. Adverse Trace position

We assess this as a high-severity but low-urgency item for most EMEA financial services clients: the CVSS 8.2/HIGH rating is confirmed, but the local vector, low-privilege requirement, and user-interaction dependency make opportunistic exploitation difficult, and no exploitation is on record in the verified data. The risk concentrates in clients with Desigo CC in managed branch or headquarters facilities, where an engineering client compromise would sit on a network path between building systems and corporate IT, and where third-party facilities contractors may hold Graphics application privileges. The absence of any vendor fix means exposure persists until Siemens ships a patch, so the Graphics authorisation review and workstation allowlisting in §4 are the controls that actually reduce risk now. We will track SSA-330084 for a fix release and for any KEV listing, and we will reissue this advisory if either changes the picture.

---

[Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-05?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*