Vulnerability · Published Aug 14, 2020 · Assigned by siemens

CVE-2020-10055

Critical 9.8

In plain English

A critical-severity code injection in Desigo CC from Siemens AG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.0% (higher than 93% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)6.0%top 6.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applications are delivered with a 3rd party component (BIRT) that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on the server with SYSTEM privileges.

Affected products (as reported)

Vendor	Product	Versions
Siemens AG	Desigo CC	V4.x
Siemens AG	Desigo CC	V3.x
Siemens AG	Desigo CC Compact	V4.x
Siemens AG	Desigo CC Compact	V3.x

Weakness: CWE-94

References

https://cert-portal.siemens.com/productcert/pdf/ssa-786743.pdf x_refsource_MISC
https://us-cert.cisa.gov/ics/advisories/icsa-20-224-06 x_refsource_MISC