Siemens Desigo CC family
Siemens Desigo CC graphics documents can run attacker scripts and compromise client operating systems.
CISA republished Siemens SSA-330084 covering CVE-2026-34223, a client code-execution flaw in the Desigo CC building-management family. Scripts embedded in user-defined graphics are not sufficiently validated and run when a privileged user opens a crafted document, allowing arbitrary file writes on the client. CVSS 3.1 is 8.2, with local access and user interaction required. All Desigo CC V6 and V7 versions are listed as affected. Michelin CERT reported the issue; no exploitation is stated.
- CVE-2026-34223 is client code injection scored CVSS 8.2.
- Crafted graphics documents execute scripts when a privileged user opens them.
- Attackers can write arbitrary files and compromise the client operating system.
- Every Desigo CC family V6 and V7 release is listed as affected.
- CVEs
- CVE-2026-34223
- Vendors
- Siemens
- Products
- Desigo CC
- Organizations
- CISASiemens ProductCERTMichelin CERT
- Countries
- Germany
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-34223 | Client Code Execution via malicious graphics documents in Siemens Desigo CC | 8.6 | <1% |
From the original article
3 min read at cisa.govView CSAF Summary A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.