ICSA-25-135-04: Siemens Desigo

Summary

Desigo CC deployments that use Installed Client are impacted by an information disclosure vulnerability which could result in information leak from the Desigo CC server. The other Desigo CC client options, Windows App Client and Flex Client, are not affected by this vulnerability. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. CVE-2024-23815: The affected server application fails to authenticate specific client requests. Modification of the client binary could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database via the event port (default: 4998/tcp)

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-25-135-04
Status: Final · version 1
Initial release: 2025-05-13
Last revised: 2025-05-13
Vendor: Siemens
Critical infrastructure sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
Deployed: Worldwide
Vendor headquarters: Germany

Republished vendor advisory. This ICSA is a verbatim republication of Siemens ProductCERT SSA-523418 from a direct conversion of their vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…

General Recommendations: As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.

Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Credit: Siemens ProductCERT

Affected products (1)

Desigo CC — all versions

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2024-23815	CWE-306 Missing Authentication for Critical Function	7.5 High	CVE-2024-23815 The affected server application fails to authenticate specific client requests. Modification of the client binary could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database via the event port (default: 4998/tcp) Mitigation: Restrict access to the server's event port (default: 4998/tcp) Vendor fix: On the Desigo CC server, disable the support for Installed Clients Affected, fixed & timeline Affected: Desigo CC all versions

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-23815	7.5 High	Siemens Desigo CC A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside …

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Siemens 2 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.

CyberzSOC