PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-26495 Siemens CVE debrief

A use-after-free vulnerability in the Open Design Alliance Drawings SDK (versions before 2024.1) affects Siemens COMOS. The flaw can be triggered when parsing specially crafted DWG files and may enable arbitrary code execution when chained with other vulnerabilities. The vulnerability was disclosed on August 13, 2024, with a CVSS 3.1 score of 7.8 (HIGH). Siemens has released COMOS V10.5 as a fix.

Vendor
Siemens
Product
COMOS
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-06-13
Original CVE updated
2023-11-14
Advisory published
2023-06-13
Advisory updated
2023-11-14

Who should care

Organizations operating Siemens COMOS in engineering, plant design, or industrial automation environments. Asset owners in critical infrastructure sectors using COMOS for process control system design and documentation. Security teams responsible for OT/ICS software supply chain risk management.

Technical summary

The vulnerability exists in the Open Design Alliance Drawings SDK versions prior to 2024.1, which is integrated into Siemens COMOS. A use-after-free condition can be triggered during DWG file parsing, potentially leading to memory corruption. Successful exploitation requires user interaction to open a malicious file, but could result in arbitrary code execution when combined with additional vulnerabilities. The attack vector is local, requiring user interaction, with low attack complexity and no privileges required.

Defensive priority

HIGH

Recommended defensive actions

  • Update Siemens COMOS to V10.5 or later to address the underlying Open Design Alliance Drawings SDK vulnerability
  • Ensure all DWG files imported into COMOS originate from trusted sources and are transmitted over secure channels
  • Implement application whitelisting and least-privilege execution for COMOS installations
  • Monitor for suspicious DWG file handling or unexpected COMOS process behavior
  • Review and apply CISA ICS recommended practices for defense-in-depth security controls

Evidence notes

The vulnerability resides in the Open Design Alliance Drawings SDK, a third-party component used by Siemens COMOS for DWG file processing. The use-after-free condition occurs during parsing of maliciously crafted DWG files. The ZDI-CAN-19162 and ZDI-CAN-19432 identifiers indicate this was reported through the Zero Day Initiative. CISA published advisory ICSA-24-228-08 on August 13, 2024, coordinating disclosure with Siemens.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-26495 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-26495

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-26495 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-26495

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-228-08.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-659443.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-659443.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-08

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.