A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applications are delivered with a 3rd party component (BIRT) that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on the server with SYSTEM privileges.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-786743.pdf | Patch Vendor Advisory |
| https://us-cert.cisa.gov/ics/advisories/icsa-20-224-06 | Patch Third Party Advisory US Government Resource |
| https://cert-portal.siemens.com/productcert/pdf/ssa-786743.pdf | Patch Vendor Advisory |
| https://us-cert.cisa.gov/ics/advisories/icsa-20-224-06 | Patch Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 04:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-786743.pdf - Patch, Vendor Advisory | |
| References | () https://us-cert.cisa.gov/ics/advisories/icsa-20-224-06 - Patch, Third Party Advisory, US Government Resource |
Information
Published : 2020-08-14 16:15
Updated : 2024-11-21 04:54
NVD link : CVE-2020-10055
Mitre link : CVE-2020-10055
CVE.ORG link : CVE-2020-10055
JSON object : View
Products Affected
siemens
- desigo_consumption_control
- desigo_consumption_control_compact
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')