CVE-2026-34223: CWE-94: Improper Control of Generation of Code ('Code Injection') in Siemens Desigo CC ClickOnce Client V6

This vulnerability (CVE-2026-34223) in Siemens Desigo CC clients involves improper control of code generation (CWE-94). The affected applications do not properly validate scripts embedded within user-defined graphics documents. An attacker can embed malicious commands in such a document, and when a user opens it, the embedded script executes on the client, allowing arbitrary file writes to the operating system. Exploitation requires user interaction with a maliciously crafted graphics document and privileges sufficient to execute the code. The vulnerability affects all versions of multiple Desigo CC client variants. The CVSS 3.1 base score is 8.2, indicating high severity, with attack vector local, low attack complexity, low privileges required, and user interaction needed. The impact includes high confidentiality, integrity, and availability impacts.

Successful exploitation can lead to arbitrary code execution on the client system, allowing an attacker to write files arbitrarily to the operating system. This compromises the client OS and may enable lateral movement within the affected organization. The vulnerability impacts confidentiality, integrity, and availability at a high level.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted or suspicious graphics documents within the affected Desigo CC clients and limit privileges of users to reduce potential impact.