CVE-2020-10055

9.8CRITICAL

Key Information:

Vendor
Siemens
Status
Desigo Cc
Desigo Cc Compact
Vendor
CVE Published:
14 August 2020

Summary

A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applications are delivered with a 3rd party component (BIRT) that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on the server with SYSTEM privileges.

Affected Version(s)

Desigo CC V4.x

Desigo CC V3.x

Desigo CC Compact V4.x

References

https://cert-portal.siemens.com/productcert/pdf/ssa-78674...
x_refsource_MISC
https://us-cert.cisa.gov/ics/advisories/icsa-20-224-06
x_refsource_MISC

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.