CVE-2021-37181
A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC C...
Affects 3 products across 1 vendor.
Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability exists in multiple versions of Siemens' Cerberus DMS and Desigo CC systems, allowing unauthenticated attackers to execute arbitrary code due to insufficient validation during deserialization. This poses significant risks to operational continuity and safety in industrial environments.
BSID: BS-2021-GLOBAL-304230-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-37181?
What is the CVSS score for CVE-2021-37181?
Is CVE-2021-37181 actively exploited?
How do I remediate CVE-2021-37181?
What systems are affected by CVE-2021-37181?
What NERC-CIP standard applies to CVE-2021-37181?
What IEC 62443 requirement maps to CVE-2021-37181?
| CVE ID | CVE-2021-37181 |
|---|---|
| BSID | BS-2021-GLOBAL-304230-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2021-09-14 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability.
Source: NIST NVD / MITRE CVE Database
The vulnerability can be exploited remotely over the network without authentication. An attacker can send specially crafted data to the affected systems, leading to arbitrary code execution. The CCOM communication component, used for Windows App / Click-Once and IE Web / XBAP client connectivity, is particularly vulnerable.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Siemens | Desigo Cc | 4.0 4.1 4.2 5.0 |
| Siemens | Cerberus Dms | 4.0 4.1 4.2 5.0 |
| Siemens | Desigo Cc Compact | 4.0 4.1 4.2 5.0 |
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict input validation and sanitization on all incoming data, especially for the CCOM communication component. Consider deploying a web application firewall (WAF) to filter out suspicious traffic.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 as it allows unauthorized access to the control system, which could compromise the integrity and availability of critical assets.
This CVE maps to SR 7.6 because it involves a lack of proper input validation, which is essential for preventing unauthorized access and ensuring the security of the system.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | aeec5b738d7ccb0c4d85d7e969f9dc2a87d0d2583cc4c4627c09bef41c52b813f226a873d0c96383dd61b69dc2ce1ed896f2b356f2b955ce557f761628143cdc |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →