CVE-2024-54005

Severity: medium (CVSS 5.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-10 · updated 2026-06-17
Weakness: CWE-611

Description

A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The PDMS/E3D Engineering Interface improperly handles XML External Entity (XXE) entries when communicating with an external application. This could allow an attacker to extract any file with a known location on the user's system or accessible network folders by injecting malicious data into the communication channel between the two systems.

Affected products

Siemens COMOS V10.3: before V10.3.3.5.8 — fixed in V10.3.3.5.8
Siemens COMOS V10.4.0: all versions
Siemens COMOS V10.4.1: all versions
Siemens COMOS V10.4.2: all versions
Siemens COMOS V10.4.3: before V10.4.3.0.47 — fixed in V10.4.3.0.47
Siemens COMOS V10.4.4: before V10.4.4.2 — fixed in V10.4.4.2
Siemens COMOS V10.4.4.1: before V10.4.4.1.21 — fixed in V10.4.4.1.21

How to fix

Upgrade to a fixed version: Siemens COMOS V10.3 V10.3.3.5.8; Siemens COMOS V10.4.3 V10.4.3.0.47; Siemens COMOS V10.4.4 V10.4.4.2; Siemens COMOS V10.4.4.1 V10.4.4.1.21. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-701627.html

Get alerted when CVE-2024-54005 or the next vulnerability affects your stack