CVE-2026-34223

Siemens Desigo CC client applications (ClickOnce, Flex, and Installed Client variants) insufficiently validate scripts embedded in user-defined graphics documents, enabling script injection (CWE-94). To trigger it, an attacker must craft a graphics document containing malicious script commands and entice a user with sufficient privileges to open it in the client application; the embedded script then executes within that client instance. Successful exploitation allows the attacker to write arbitrary files to the client's operating system, which can lead to full compromise of the client workstation and lateral movement within the organization's network. All client variants and versions listed (V6 through V9) are affected, so operators and engineers running Desigo CC building-management clients are in scope. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a roughly 0.1% probability of exploitation within 30 days (3rd percentile).

What to do: No fixed versions are listed in this record, so check the Siemens ProductCERT advisory for CVE-2026-34223 and apply updated client builds when released. Until then, only open or import user-defined graphics documents from trusted sources, avoid shared graphics libraries of unknown origin, and run Desigo CC clients under least-privilege accounts to limit file-write impact. Inventory which client variants (ClickOnce, Flex, Installed) and versions (V6–V9) are deployed and whether users routinely open externally supplied graphics.