Information Disclosure Vulnerability in Desigo CC

An attacker with network access could retrieve sensitive configuration, credential, or operational data from your Desigo CC building management system, potentially exposing details about HVAC, lighting, security, or other building automation systems under management.

Organizations operating Siemens Desigo CC building management systems that use the Installed Client deployment option. This affects facilities managing HVAC, lighting, security, or other building automation systems, particularly in water utilities, electric utilities, or municipal facilities that use Desigo CC for facility management.

An attacker on the network sends unauthenticated requests to the Desigo CC server targeting the Installed Client interface. Because no authentication is required and the vulnerability requires no special configuration, the attacker can extract sensitive information from the server without any prior access or credentials.