PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-47875 Siemens CVE debrief

CVE-2024-47875 is a critical issue published by CISA for Siemens COMOS, with the advisory description pointing to a DOMPurify nesting-based mXSS weakness. The source record ties the issue to Siemens COMOS V10.4, V10.4.5, V10.5, and V10.6 product lines, and lists fixed releases that should be deployed as soon as practical. Because the CVSS vector is network-reachable and requires no privileges or user interaction, this should be treated as a high-priority remediation item for any exposed COMOS deployment.

Vendor
Siemens
Product
COMOS V10.4
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-09
Original CVE updated
2026-03-12
Advisory published
2025-12-09
Advisory updated
2026-03-12

Who should care

Siemens COMOS administrators, OT/industrial engineering teams, application owners using COMOS, and vulnerability management teams responsible for engineering workstations or servers that host COMOS. Security teams should also review any integrations or web-facing services that rely on the affected COMOS deployment.

Technical summary

The advisory text describes a DOMPurify nesting-based mXSS condition, indicating a cross-site scripting sanitation flaw in a DOM-based HTML/SVG/MathML sanitization path. In the Siemens advisory context, CISA maps this to Siemens COMOS and lists affected product lines. The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H, which indicates network attackability, low complexity, no privileges, no user interaction, and high integrity/availability impact with changed scope. The source revision history shows subsequent updates adding fixes for COMOS V10.4.5 and COMOS V10.6.

Defensive priority

Critical. The combination of network reachability, no privileges, no user interaction, and high impact makes this a priority patch for affected COMOS environments.

Recommended defensive actions

  • Update Siemens COMOS to V10.4.5 or later for the V10.4 line, per the vendor remediation guidance.
  • Update Siemens COMOS to V10.5.2 or later where that product line applies, per the vendor remediation guidance.
  • Apply the latest Siemens ProductCERT guidance and confirm whether your deployment is among the affected COMOS versions listed in the advisory.
  • Inventory any COMOS instances exposed to broader internal networks or shared engineering environments and prioritize them for remediation.
  • Review compensating controls and apply CISA ICS recommended practices while patching is scheduled.

Evidence notes

Source corpus ties the CVE to Siemens COMOS via the CISA CSAF advisory ICSA-26-043-03 and Siemens ProductCERT SSA-212953 references. The advisory description itself references DOMPurify and a nesting-based mXSS condition, while the vendor/product context is Siemens COMOS; this should be treated as an advisory-context mapping rather than as a standalone DOMPurify package bulletin. Publication date used here is 2025-12-09, with later advisory updates on 2026-02-10 and 2026-03-10/2026-03-12 reflected in the supplied timeline.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-47875 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-47875

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-47875 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-47875

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-043-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-212953.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-212953.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.