Siemens Desigo CC vulnerable to Client Code Execution

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A code-injection flaw in Siemens Desigo CC V6/V7 lets attackers execute arbitrary code on client machines via malicious graphics documents; no fix is currently available.

Sourcecisa.gov — open the original

CISA republished a Siemens ProductCERT advisory (SSA-330084) describing a Client Code Execution vulnerability (CVE-2026-34223) in the Desigo CC building management product family, affecting all versions of V6 and V7. The flaw stems from insufficient input validation of scripts embedded in user-defined graphics documents. An attacker who crafts a malicious graphics document and convinces a privileged user to open it can trigger execution of embedded script code on the client application instance, enabling arbitrary file writes to the client OS. This could lead to full compromise of the client operating system and provide a foothold for lateral movement within the organization.

Exploitation requires social engineering (enticing a user to open a crafted document) and does not appear to have a known in-the-wild exploitation status per this advisory. No patch is currently available; Siemens recommends mitigating by restricting the graphics-editing authorization policy to least-privilege principles so only necessary users can create or modify graphics documents. General ICS hardening guidance also applies: isolate control system networks from business networks and the internet, use VPNs with care for any required remote access, and follow Siemens' operational guidelines for industrial security.

Affected sectors include Critical Manufacturing and Commercial Facilities, with worldwide deployment of Desigo CC building automation systems. The vulnerability was reported to Siemens by Michelin CERT. Defenders operating Desigo CC should audit who has access to create/modify graphics documents, restrict that capability, monitor for anomalous file-write activity on client systems, and watch for the release of an official Siemens patch.

title: Desigo CC Graphics Document Script Execution
description: Detects Desigo CC client process spawning script execution engines (powershell,
  cmd, cscript, wscript) following user interaction with graphics documents. This
  pattern matches CVE-2026-34223 exploitation where malicious embedded scripts in
  .ccg files execute arbitrary code on the client.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \DesigoCCApplicationService.exe
    - \DesigoCCApplicationServicex64.exe
    - \DesigoCCClient.exe
  selection_child:
    Image|endswith:
    - \powershell.exe
    - \cmd.exe
    - \cscript.exe
    - \wscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Desigo CC automation scripts deployed by administrators for legitimate system configuration
- Official Siemens Desigo CC updates or maintenance routines that invoke scripts
level: high
id: d5bfe690-5f76-5b25-87b7-031de20ee846
status: experimental
author: Vorant

title: Suspicious File Write Activity from Desigo CC Client Process
description: Detects Desigo CC client processes writing files to sensitive system
  directories (System32, Program Files, ProgramData, startup folders) following potential
  script execution. CVE-2026-34223 exploitation can lead to arbitrary file writes
  after embedded script execution.
tags:
- attack.execution
- attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \DesigoCCApplicationService.exe
    - \DesigoCCApplicationServicex64.exe
    - \DesigoCCClient.exe
    TargetFilename|contains:
    - System32
    - Program Files
    - ProgramData
    - Startup
  filter_legitimate:
    TargetFilename|endswith:
    - .log
    - .tmp
  condition: selection and not filter_legitimate
falsepositives:
- Desigo CC legitimate logging or cache operations in system directories
- Official Siemens Desigo CC installation or upgrade processes
level: medium
id: c60202f8-fe13-538b-970b-dc665274e923
status: experimental
author: Vorant

title: Desigo CC Malicious Graphics Document Interaction
description: Detects opening of Desigo CC graphics documents (.ccg, .dcg) by the Desigo
  CC client process. While legitimate, this serves as a precursor event to monitor
  in conjunction with subsequent script execution or file write anomalies when a user
  has opened a potentially malicious graphics document.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \DesigoCCApplicationService.exe
    - \DesigoCCApplicationServicex64.exe
    - \DesigoCCClient.exe
    CommandLine|contains:
    - .ccg
    - .dcg
  filter_admin_automation:
    User|contains:
    - SYSTEM
    - Administrator
  condition: selection and not filter_admin_automation
falsepositives:
- Legitimate operators opening graphics documents as part of normal Desigo CC operations
- Scheduled tasks or services opening graphics documents for legitimate automation
level: low
id: f5ab4a68-4e15-5905-a394-f7d73955c3b0
status: experimental
author: Vorant

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-05

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.