Arbitrary Deserialization Vulnerability in Cerberus DMS and Desigo CC Products
CVE-2021-37181

10CRITICAL

Key Information:

Vendor

Siemens
Status
Cerberus Dms V4.0
Cerberus Dms V4.1
Cerberus Dms V4.2
Cerberus Dms V5.0
Vendor
CVE Published:
14 September 2021

What is CVE-2021-37181?

A vulnerability in Cerberus DMS and Desigo CC products allows for arbitrary deserialization of untrusted data due to insufficient validation measures. This security flaw can be exploited by an unauthenticated attacker, potentially leading to code execution on the affected systems. Both the CCOM communication component, responsible for facilitating Windows App / Click-Once and IE Web / XBAP client connectivity, are particularly vulnerable, emphasizing the need for prompt updates to mitigate potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Cerberus DMS V4.0 All versions

Cerberus DMS V4.1 All versions

Cerberus DMS V4.2 All versions

References

https://cert-portal.siemens.com/productcert/pdf/ssa-45371...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.