# Siemens Desigo, Gridscale hit by Node.js flaw

Published: 2026-11-12 · Severity: severe · Sectors: Manufacturing, Energy, Technology
Canonical: https://vorant.io/reports/ff30bbba-da9b-56d6-8a5a-4cecbf863ac3/siemens-desigo-gridscale-hit-by-node-js-flaw
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> A critical Node.js Brotli decoder flaw (CVE-2026-111497) affects Siemens Desigo CC and Gridscale X products, enabling memory corruption and possible code execution.

Source: cisa.gov — https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-02

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-111497 as exploited in the wild.

Siemens has released an advisory, republished by CISA, addressing CVE-2026-111497 ('Node2Shell'), a critical out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js. The flaw, disclosed by the Node.js project on October 21, 2026, could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. Siemens has confirmed the vulnerability affects its Desigo CC building automation family (versions V8 and V9, all versions) and Gridscale X products including DSA (versions >=5.3 and <5.4) and PSS®E (versions <36.8.0). The vulnerability carries a CVSS v3 score of 9.8.

These products are used in building management and power grid monitoring/control contexts, with deployment reported worldwide across Critical Manufacturing, Energy, and Information Technology sectors. Siemens has released updated versions for affected products and recommends applying security updates via documented tooling and procedures, with prior validation and trained staff supervision. No in-the-wild exploitation against Siemens products specifically is mentioned in this advisory, though the underlying Node.js vulnerability was significant enough to warrant an urgent upstream fix.

Defenders operating affected Siemens Desigo CC or Gridscale X deployments should prioritize patching to the latest vendor-provided versions. General ICS hardening practices apply: minimize network exposure of control system devices, isolate control networks behind firewalls, and use VPNs for remote access where required, while recognizing VPN security depends on the security of connected endpoints. Power grid operators should also verify that multi-level redundant secondary protection schemes remain in place as a resilience measure independent of this patch.

## Mentioned in this report

- Vulnerabilities: CVE-2026-111497 (KEV)

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-316-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ff30bbba-da9b-56d6-8a5a-4cecbf863ac3/siemens-desigo-gridscale-hit-by-node-js-flaw.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup