This vulnerability (CWE-94) affects various Siemens Desigo CC client products across multiple versions. It involves improper control of code generation due to insufficient validation of embedded scripts in user-defined graphics documents. When a maliciously crafted graphics document is opened by a user, the embedded script executes on the client application, allowing arbitrary file writes to the client operating system. Exploitation requires user interaction and privileges sufficient to open the compromised document. The CVSS v3.1 base score is 8.2, reflecting high impact to confidentiality, integrity, and availability, with attack vector local, low attack complexity, low privileges required, and user interaction needed. No official patch or remediation guidance has been published by Siemens as of the data provided.

Successful exploitation allows an attacker to execute arbitrary code on the client system by embedding malicious scripts in graphics documents. This can lead to arbitrary file writes, full compromise of the client operating system, and potential lateral movement within the network. The vulnerability impacts confidentiality, integrity, and availability at a high level. Exploitation requires a user with sufficient privileges to open a malicious graphics document, making social engineering a likely attack vector.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, organizations should exercise caution when opening graphics documents from untrusted sources and limit user privileges where possible to reduce risk. Monitor Siemens advisories for updates on patches or official mitigations.