[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-siemens-desigo-cc-flaw-lets-rigged-graphics-files-run-code":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},7220,"siemens-desigo-cc-flaw-lets-rigged-graphics-files-run-code","Siemens Desigo CC Flaw Lets Rigged Graphics Files Run Code","A high-severity bug in Siemens building-automation software lets a booby-trapped graphics document execute code on a user's machine, and there is no patch yet.","A scripting flaw in Siemens' Desigo CC building-management platform can let a malicious graphics file run code on whoever opens it.\n\nThe vulnerability, tracked as CVE-2026-34223, lives in how Desigo CC handles user-defined graphics documents that carry embedded scripts. Feed it a document rigged with malicious commands, get someone with the right privileges to open it, and the client application executes that script - writing arbitrary files to the operating system underneath. It affects both the V6 and V7 branches of the Desigo CC family. Siemens and CISA rate it 8.2 out of 10, and Siemens has no fix ready; the only advice for now is to lock down who can access the Graphics application at all.\n\nDesigo CC runs building automation - HVAC, access control, the physical plant - inside critical manufacturing and commercial facilities worldwide. A code-execution bug that starts with something as mundane as opening a graphics file is a reminder that industrial software keeps inheriting the same document-based attack patterns that have dogged office suites for decades, just attached to higher-stakes machines.\n\nThe bug was reported by Michelin's internal security team, not found in the wild - for now, that is the good news.","[\"siemens\",\"desigo-cc\",\"industrial-control-systems\",\"vulnerability\"]","2026-09-22T12:00:00.000Z","2026-09-22T16:45:23.355Z","2026-09-22T16:45:30.118Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The advisory identifier 'ICSA-26-265-05' does not appear anywhere in the source material and appears fabricated — verify or remove that specific identifier before publishing, since inventing an advisory number is exactly the kind of unsupported specific this brand cannot run with.","resolved","security",[32,33,34,35],"siemens","desigo-cc","industrial-control-systems","vulnerability",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-265-05",0,{"sections":42},[43,48,52,57,62,67,72,76,81,86,91,96,101,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",4195,"2026-09-22T19:28:23.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",702,"2026-09-22T21:01:05.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",366,"2026-09-22T18:04:41.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",200,"2026-09-22T19:28:55.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",167,"2026-09-22T20:00:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Science","science",131,"2026-09-22T16:26:30.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":66},"Consumer Tech","consumer-tech",110,{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",79,"2026-09-22T19:44:31.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",78,"2026-09-18T04:00:00.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Startups","startups",63,"2026-09-22T21:24:11.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",45,"2026-09-22T15:35:06.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"General","general",43,"2026-09-21T23:48:56.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Reviews","reviews",27,"2026-09-22T13:00:00.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]