Siemens Desigo CC Family Client Code Execution Vulnerability (CVE-2026-34223)

A Client Code Execution (CCE) vulnerability has been identified in Siemens Desigo CC family products, affecting versions V6 and V7. The flaw, tracked as CVE-2026-34223, arises from insufficient input validation when the application handles scripts embedded within user-defined graphics documents. According to the advisory, when a user opens a compromised graphics document, the embedded script is executed on the client application instance. This allows an attacker to write arbitrary files to the client's operating system and potentially compromise the system. Successful exploitation requires the attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. The vulnerability has been assigned a CVSS 3.1 base score of 8.2, with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The affected products span Critical Manufacturing and Commercial Facilities sectors and have worldwide deployment. The vendor headquarters is located in Germany. The vulnerability was reported to Siemens by Michelin CERT. As of the advisory publication date, no fix is available. Siemens has issued security advisory SSA-330084, which recommends evaluating authorization policies for the Graphics application following the Least Privilege principle so that only required users have access to the configuration. Additional defensive recommendations include minimizing network exposure for control system devices, ensuring systems are not accessible from the internet, locating control system networks behind firewalls and isolating them from business networks, and using secure methods such as VPNs when remote access is required. The relevant CWE identifier is CWE-94 (Improper Control of Generation of Code).