Siemens Desigo CC family: 1 CVE, High 8.2
Summary
CISA reports 1 vulnerability in Siemens Desigo CC family V6, Desigo CC family V7, Desigo CC family V8, Desigo CC family V9. Weakness type: Improper Control of Generation of Code ('Code Injection'). A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. Highest CVSS v3 score: 8.2 (High), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Siemens
- Products
- Desigo CC family V6, Desigo CC family V7, Desigo CC family V8, Desigo CC family V9
- CVEs
- CVE-2026-34223
- Highest CVSS v3
- 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Commercial Facilities
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-34223 | Improper Control of Generation of Code ('Code Injection') | 8.2 | – | No | CVE-2026-34223 |
Affected products (4)
- Desigo CC family V6
- Desigo CC family V7
- Desigo CC family V8
- Desigo CC family V9
Vendor fixes and mitigations (from advisory)
- Mitigation: Evaluate authorization policy for Graphics application following Least Privilege principle, so only required users have access to the configuration.
- None Available: Currently no fix is available
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-265-05
- Machine-readable CSAF record
- https://cert-portal.siemens.com/productcert/csaf/ssa-330084.json
- https://cert-portal.siemens.com/productcert/html/ssa-330084.html
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.