Siemens Desigo and Gridscale hit by critical Brotli flaw CVE-2026-111497
Original title: Siemens Desigo, Gridscale
CVSS 9.8 out-of-bounds write in Brotli 1.0.3–1.2.0 can yield remote code execution; Siemens published product fixes.
CISA republished Siemens ProductCERT guidance on CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and nicknamed Node2Shell. A remote unauthenticated attacker can use a crafted Brotli stream to corrupt memory, disclose data, cause denial of service, or potentially run code. Desigo CC V8 and V9 and named Gridscale X releases are affected; Siemens says updated versions or .NET security updates are available. The advisory does not report exploitation.
Unconfirmed: The advisory does not say whether attackers are exploiting CVE-2026-111497.
- Node.js published Brotli decoder fixes on October 21, 2026.
- Google Brotli 1.0.3 through 1.2.0; fixed in 1.0.10, 1.1.1, or 1.2.1.
- Gridscale X DSA from V5.3 before V5.4 should move to V5.4 or later.
- Gridscale X PSS®E before V36.8.0 should update to V36.8.0 or later.
- CVSS 3.1 base score is 9.8; CWE-787; sectors include energy and manufacturing.
Impact: Remote memory corruption, disclosure, denial of service, or code execution
| Product | Affected | Fixed in |
|---|---|---|
| Siemens Desigo CC family V8 | all | — |
| Siemens Desigo CC family V9 | all | — |
| Siemens Gridscale X DSA | >= V5.3 < V5.4 | V5.4 or later |
| Siemens Gridscale X PSS®E | < V36.8.0 | V36.8.0 or later |
| Google Brotli | 1.0.3 through 1.2.0 | 1.0.10, 1.1.1, or 1.2.1 |
- 1.Install the latest .NET security updates via Windows Update for Desigo CC V8 and V9.
- 2.Update Gridscale X DSA to V5.4 or later.
- 3.Update Gridscale X PSS®E to V36.8.0 or later.
- CVEs
- CVE-2026-111497
- Organizations
- CISASiemens ProductCERT
- Countries
- Germany
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
4 min read at cisa.govView CSAF Summary On October 21, 2026, the Node. js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node. js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497).
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.