PT-2025-20843 · Siemens · Desigo Cc
Published
2025-05-13
·
Updated
2025-05-18
·
CVE-2024-23815
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone)
Desigo CC (All versions if access from Installed Clients to Desigo CC server is only allowed within highly protected zones)
Description:
A vulnerability has been identified where the affected server application fails to authenticate specific client requests. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database via the event port (default: 4998/tcp).
Recommendations:
For Desigo CC versions where access from Installed Clients to the Desigo CC server is allowed from networks outside of a highly protected zone, restrict access to the event port (default: 4998/tcp) to minimize the risk of exploitation.
For Desigo CC versions where access from Installed Clients to the Desigo CC server is only allowed within highly protected zones, ensure that the network zone remains highly protected to prevent unauthorized access.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Desigo Cc