[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-siemens-adds-desigo-cc-and-gridscale-to-nodejs-flaw-advisory":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12960,"siemens-adds-desigo-cc-and-gridscale-to-nodejs-flaw-advisory","Siemens Adds Desigo CC and Gridscale to Node.js Flaw Advisory","Siemens added Desigo CC and two Gridscale X products to its advisory on a CVSS 9.8 Node.js Brotli flaw within 16 days of the upstream fix.","Siemens has added Desigo CC and two Gridscale X products to its advisory on \"Node2Shell,\" a critical flaw in the Brotli decoder bundled with Node.js.\n\nThe Node.js project released fixes on October 21 for CVE-2026-111497. It is an out-of-bounds write, meaning code writes data past the end of the memory it was given, in the part of Node.js that decompresses Brotli data. A remote attacker could corrupt memory and potentially run arbitrary code. The flaw scores 9.8 out of 10 on the CVSS severity scale. Its vector shows it is reachable over the network, needs no privileges, and needs no user interaction.\n\nSiemens published its advisory on October 30. On November 4 it added Desigo CC, listing all versions of V8 and V9. On November 6 it added Gridscale X DSA (V5.3 up to, but not including, V5.4) and Gridscale X PSS®E (anything before V36.8.0). The fixes are V5.4 or later for DSA and V36.8.0 or later for PSS®E. The text lists no fixed version for Desigo CC, though Siemens said it has released new versions for the affected products and recommends updating to the latest.\n\nThe Gridscale entries carry both known_affected and known_not_affected statuses, so the advisory does not say every configuration is vulnerable. Operators need to check their exact product and version against it.\n\nThe timeline is the useful part. The list grew 5 and 7 days after publication, which is 14 and 16 days after the upstream fix. Anyone who read the October 30 version and moved on had an incomplete picture, so it is worth rechecking.\n\nSiemens also told operators of critical power systems that grid designs with redundant secondary protection limit the effect of cyber incidents on reliability. That is the company's own framing. It recommends validating updates before applying them, supervision by trained staff, and keeping network access behind firewalls, segmentation or VPNs.\n\nThe advisory does not say whether anyone has exploited the flaw.","[\"siemens\",\"nodejs\",\"ics-security\",\"vulnerability\"]","2026-11-12T12:00:00.000Z","2026-11-12T17:40:27.705Z","2026-11-12T17:40:27.993Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Cut or properly support the Log4Shell analogy and the unsourced claim that customers rarely know what components are inside their software, because the advisory's revision history shows additions 5 and 7 days after publication (about 16 days after the Node.js fix), not 'weeks', and neither claim has a source; also drop or source the 'building software' label for Desigo CC and the 'reaches all of them' wording, since the Gridscale entries list both known_affected and known_not_affected statuses.","resolved","security",[32,33,34,35],"siemens","nodejs","ics-security","vulnerability",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-316-02",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7151,"2026-11-13T11:05:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1132,"2026-11-12T15:35:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",653,"2026-11-13T11:52:26.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",621,"2026-11-12T19:54:30.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",370,"2026-11-12T17:00:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",337,"2026-11-12T15:31:12.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",232,"2026-11-13T12:00:40.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",172,"2026-11-13T11:04:24.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",160,"2026-11-12T17:31:47.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",120,"2026-11-13T11:33:19.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",109,"2026-11-13T10:00:00.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]