Siemens COMOS out-of-bounds write DoS and RCE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Out-of-bounds write in COMOS before V10.6 via crafted DWF files allows crash or code execution; no active exploitation.
Siemens COMOS is affected by an out-of-bounds write vulnerability (CVE-2024-8894) in the Open Design Alliance Drawings SDK before version 2025.10. The flaw exists in the handling of crafted DWF files; missing validation on SectionIterator data can trigger an unhandled exception. Successful exploitation requires local access and user interaction (opening a malicious file), and could enable denial-of-service via crash or potential code execution. CVSS score is 8.2 (AV:L/AC:L/PR:N/UI:R). All COMOS versions prior to V10.6 are affected. CISA reports no known public exploitation targeting this vulnerability at the time of advisory publication. The vulnerability is not remotely exploitable. Mitigation requires updating to COMOS V10.6 or later, or restricting file imports to trusted sources transmitted over secure channels.
Mentioned in this report
Detection guidance
Siemens COMOS Spawning Shell or Script Interpreter
COMOS spawning a command shell or scripting host, which could indicate code execution after a malicious DWF file is opened (CVE-2024-8894 style client-side exploitation). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Siemens COMOS Spawning Shell or Script Interpreter
id: dbbdc8b5-a41a-502f-9dcb-484bd01c6a40
status: experimental
description: Detects a Siemens COMOS process spawning a command shell, script host
or LOLBin. COMOS does not normally launch these, so a child like this after opening
a crafted DWF file could indicate exploitation of the Open Design Alliance Drawings
SDK out-of-bounds write (CVE-2024-8894). Generalised on the parent/child relation,
not on any specific payload. The advisory reports no known public exploitation,
so this is a hypothetical post-exploitation detection.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: \COMOS
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- COMOS plugins or customer automation scripts that legitimately call cmd.exe or PowerShell
for batch import and export jobs
- Installer or updater routines launched from the COMOS directory
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs