Log in Start free

Vulnerability · Published Sep 14, 2021 · Assigned by siemens

CVE-2021-37181

Critical 10.0

In plain English

A critical-severity unsafe deserialization in Cerberus DMS V4.0 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS NVD)10.0Critical
Exploit odds (30 days)1.9%top 20.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.

Affected products (as reported)

VendorProductVersions
Siemens Cerberus DMS V4.0 All versions
Siemens Cerberus DMS V4.1 All versions
Siemens Cerberus DMS V4.2 All versions
Siemens Cerberus DMS V5.0 All versions < v5.0 QU1
Siemens Desigo CC Compact V4.0 All versions
Siemens Desigo CC Compact V4.1 All versions
Siemens Desigo CC Compact V4.2 All versions
Siemens Desigo CC Compact V5.0 All versions < V5.0 QU1
Siemens Desigo CC V4.0 All versions
Siemens Desigo CC V4.1 All versions
Siemens Desigo CC V4.2 All versions
Siemens Desigo CC V5.0 All versions < V5.0 QU1

Weakness: CWE-502

References