PT-2025-20843 · Siemens · Desigo Cc

Published

2025-05-13

·

Updated

2025-05-18

·

CVE-2024-23815

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone) Desigo CC (All versions if access from Installed Clients to Desigo CC server is only allowed within highly protected zones)
Description: A vulnerability has been identified where the affected server application fails to authenticate specific client requests. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database via the event port (default: 4998/tcp).
Recommendations: For Desigo CC versions where access from Installed Clients to the Desigo CC server is allowed from networks outside of a highly protected zone, restrict access to the event port (default: 4998/tcp) to minimize the risk of exploitation. For Desigo CC versions where access from Installed Clients to the Desigo CC server is only allowed within highly protected zones, ensure that the network zone remains highly protected to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2025-06609
CVE-2024-23815

Affected Products

Desigo Cc