File Parsing Vulnerabilities in COMOS

A user tricked into opening a malicious drawing file in COMOS could allow an attacker to leak sensitive data (like process designs or credentials) or execute arbitrary code with the privileges of the COMOS application, potentially affecting plant engineering and operational integrity.

Plant engineers and control systems administrators who use Siemens COMOS for process design, documentation, and automation engineering should care about this vulnerability. COMOS is used to create and manage industrial plant designs, and compromise of the engineering workstation could allow attackers to modify plant designs, inject malicious logic, or steal intellectual property.

An attacker sends a malicious DGN, DXF, or DWG file to a COMOS user. When the user opens the file in COMOS, the vulnerable Drawings SDK parser processes the crafted file, triggering a buffer overflow or memory corruption. The attacker can then read memory (information disclosure) or redirect execution to run arbitrary code on the engineering workstation.