Read the docs
TI-2021-15243 Aliases CVE-2021-37181GHSA-xxcg-h8cr-979m

Deserialization of untrusted data in Siemens Cerberus DMS V4.0

Priority MEDIUM 47CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.

Why it matters now

EPSS 0.0189 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensCerberus DMS V4.0All versions—No fix listedCNA
SiemensCerberus DMS V4.1All versions—No fix listedCNA
SiemensCerberus DMS V4.2All versions—No fix listedCNA
SiemensCerberus DMS V5.0All versions < v5.0 QU1—No fix listedCNA
SiemensDesigo CC Compact V4.0All versions—No fix listedCNA
SiemensDesigo CC Compact V4.1All versions—No fix listedCNA
SiemensDesigo CC Compact V4.2All versions—No fix listedCNA
SiemensDesigo CC Compact V5.0All versions < V5.0 QU1—No fix listedCNA
SiemensDesigo CC V4.0All versions—No fix listedCNA
SiemensDesigo CC V4.1All versions—No fix listedCNA
SiemensDesigo CC V4.2All versions—No fix listedCNA
SiemensDesigo CC V5.0All versions < V5.0 QU1—No fix listedCNA
  • Cerberus DMS V4.0 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Cerberus DMS V4.1 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Cerberus DMS V4.2 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Cerberus DMS V5.0 VendorSiemens Affected All versions < v5.0 QU1 Fixed in — No fix listed CNA
  • Desigo CC Compact V4.0 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Desigo CC Compact V4.1 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Desigo CC Compact V4.2 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Desigo CC Compact V5.0 VendorSiemens Affected All versions < V5.0 QU1 Fixed in — No fix listed CNA
  • Desigo CC V4.0 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Desigo CC V4.1 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Desigo CC V4.2 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • Desigo CC V5.0 VendorSiemens Affected All versions < V5.0 QU1 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:siemens:cerberus_dms:4.0:*:*:*:*:*:*:*4.0VulnerableSiemens
cpe:2.3:a:siemens:cerberus_dms:4.1:*:*:*:*:*:*:*4.1VulnerableSiemens
cpe:2.3:a:siemens:cerberus_dms:4.2:*:*:*:*:*:*:*4.2VulnerableSiemens
cpe:2.3:a:siemens:cerberus_dms:5.0:-:*:*:*:*:*:*5.0VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc:4.0:*:*:*:*:*:*:*4.0VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc:4.1:*:*:*:*:*:*:*4.1VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc:4.2:*:*:*:*:*:*:*4.2VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc:5.0:-:*:*:*:*:*:*5.0VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_compact:4.0:*:*:*:*:*:*:*4.0VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_compact:4.1:*:*:*:*:*:*:*4.1VulnerableSiemens
  • cpe:2.3:a:siemens:cerberus_dms:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:cerberus_dms:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:cerberus_dms:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:cerberus_dms:5.0:-:*:*:*:*:*:* Versions 5.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc:5.0:-:*:*:*:*:*:* Versions 5.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_compact:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_compact:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Siemens
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:desigo_cc_compact:4.2:*:*:*:*:*:*:*4.2VulnerableSiemens
cpe:2.3:a:siemens:desigo_cc_compact:5.0:-:*:*:*:*:*:*5.0VulnerableSiemens
  • cpe:2.3:a:siemens:desigo_cc_compact:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:desigo_cc_compact:5.0:-:*:*:*:*:*:* Versions 5.0 Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37181
  2. 2026-10-03 Alias added: GHSA-xxcg-h8cr-979m

References

Patch 1

  • TI-2022-14579 Improper authentication in Siemens Cerberus DMS CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences