Arbitrary Deserialization Vulnerability in Cerberus DMS and Desigo CC Products
CVE-2021-37181

10CRITICAL

Key Information:

Vendor
Siemens
Status
Cerberus Dms V4.0
Cerberus Dms V4.1
Cerberus Dms V4.2
Cerberus Dms V5.0
Vendor
CVE Published:
14 September 2021

Summary

A vulnerability in Cerberus DMS and Desigo CC products allows for arbitrary deserialization of untrusted data due to insufficient validation measures. This security flaw can be exploited by an unauthenticated attacker, potentially leading to code execution on the affected systems. Both the CCOM communication component, responsible for facilitating Windows App / Click-Once and IE Web / XBAP client connectivity, are particularly vulnerable, emphasizing the need for prompt updates to mitigate potential exploits.

Affected Version(s)

Cerberus DMS V4.0 All versions

Cerberus DMS V4.1 All versions

Cerberus DMS V4.2 All versions

References

https://cert-portal.siemens.com/productcert/pdf/ssa-45371...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.