CVE-2020-10055: Siemens Desigo Consumption Control

Critical severity, CVSS 9.8. EPSS: 6% chance of exploitation in the next 30 days.

A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applications are delivered with a 3rd party component (BIRT) that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on the server with SYSTEM privileges.

Affected products

• Siemens Desigo Consumption Control: version 3.0 only; version 4.0 only
• Siemens Desigo Consumption Control Compact: version 3.0 only; version 4.0 only

Published 2020-08-14. Last modified 2026-06-17.