Siemens Desigo CC: 1 CVE, Critical 9.8
Summary
CISA reports 1 vulnerability in Siemens Desigo CC family V7, Desigo CC family V8, Desigo CC family V9. Weakness type: Out-of-bounds Write. OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends to update to the latest versions. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- Siemens
- Products
- Desigo CC family V7, Desigo CC family V8, Desigo CC family V9
- CVEs
- CVE-2025-15467
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2025-15467 | Out-of-bounds Write | 9.8 | – | No | CVE-2025-15467 |
Affected products (3)
- Desigo CC family V7
- Desigo CC family V8
- Desigo CC family V9 < V9.0.1
Vendor fixes and mitigations (from advisory)
- None Available: Currently no fix is available
- Vendor Fix: Update to V9.0 QU1 or later version link
- Vendor Fix: Update to patch V8.0 QU2.0021
- Vendor Fix: https://support.industry.siemens.com/cs/ww/en/view/109989041/
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-209-01
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-734552.json
- https://cert-portal.siemens.com/productcert/html/ssa-734552.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.