CVE-2024-23815: Desigo CC Auth Bypass Vulnerability

CVE-2024-23815 Overview

CVE-2024-23815 is a missing authentication vulnerability [CWE-306] in Siemens Desigo CC, a building management and control platform. The affected server fails to authenticate specific client requests received on the event port (default 4998/tcp). An attacker who modifies the Desigo CC client binary can issue arbitrary SQL queries against the server database without credentials. Siemens documented the issue in advisory SSA-523418. The flaw affects all versions of Desigo CC where Installed Clients communicate with the server, with the highest exposure when access is permitted from networks outside a highly protected zone.

Critical Impact
An unauthenticated remote attacker with a modified client can execute arbitrary SQL queries against the Desigo CC database, exposing operational technology data in building automation environments.

Affected Products

Siemens Desigo CC (all versions) when client access is permitted from networks outside a highly protected zone
Siemens Desigo CC (all versions) when client access is restricted to highly protected zones
Deployments exposing the event port 4998/tcp to Installed Clients

Discovery Timeline

2025-05-13 - CVE-2024-23815 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-23815

Vulnerability Analysis

The Desigo CC server exposes a service on TCP port 4998 used for event communication with Installed Clients. The server does not authenticate certain client requests received on this channel. Authentication is implicitly assumed to be enforced by the legitimate client binary rather than by the server. This design pattern places trust on the client side of an untrusted boundary.

The vulnerability is classified under [CWE-306] Missing Authentication for Critical Function. Exploitation requires only network reachability to the event port. The attacker does not need valid credentials, prior privileges, or user interaction. Successful exploitation grants the ability to send arbitrary SQL queries that the server executes against its database.

Root Cause

The server-side handler trusts the Desigo CC client to enforce authentication and to constrain the SQL operations it issues. By modifying the client binary, an attacker bypasses these client-enforced checks and sends crafted database requests that the server processes without verification. The server lacks server-side validation of the requestor identity and of the queries it accepts.

Attack Vector

The attack is performed over the network against TCP port 4998. The attacker obtains and modifies the Desigo CC client binary to remove client-side restrictions, then connects to the Desigo CC server and submits arbitrary SQL statements. Exposure increases when the event port is reachable from networks outside the highly protected zone defined in the Siemens architecture guidance. See the Siemens Security Advisory SSA-523418 for product-specific technical context. No public proof-of-concept code has been verified for this issue.

Detection Methods for CVE-2024-23815

Indicators of Compromise

Unexpected TCP connections to port 4998 originating from hosts that are not approved Installed Client workstations
Database query patterns inconsistent with normal Desigo CC client workflows, including direct SELECT, INSERT, UPDATE, or DROP statements
Unsigned, mismatched, or out-of-band Desigo CC client binaries observed on operator workstations

Detection Strategies

Monitor network flows for sessions to 4998/tcp from source addresses outside the approved client allow-list
Apply file integrity monitoring to the Desigo CC client binary to flag unauthorized modification or replacement
Correlate authentication events at the perimeter with database activity on the Desigo CC server to identify unauthenticated query bursts

Monitoring Recommendations

Enable database audit logging on the Desigo CC backend and review for queries not initiated by service accounts
Capture and retain NetFlow or packet metadata for the OT segment hosting Desigo CC for retrospective hunting
Alert on first-seen client hostnames or process hashes connecting to the event port

How to Mitigate CVE-2024-23815

Immediate Actions Required

Restrict access to the Desigo CC event port 4998/tcp to a highly protected zone using firewall rules
Inventory all Installed Clients and remove any that are not required for operations
Validate the integrity of deployed client binaries and replace any unauthorized copies
Apply the remediation guidance published by Siemens in advisory SSA-523418

Patch Information

Siemens has published mitigation and update guidance in Siemens Security Advisory SSA-523418. Operators should consult the advisory for the fixed versions and configuration changes applicable to their Desigo CC deployment. The EPSS score for this CVE is 0.469% (percentile 36.808) as of 2026-06-16.

Workarounds

Limit Desigo CC client-to-server communication to a dedicated, segmented OT network behind a stateful firewall
Place the Desigo CC server inside a highly protected zone and block 4998/tcp from all other networks
Use a jump host or VPN with strong authentication for any remote administrative access to Installed Clients
Enforce strict allow-listing of source addresses authorized to reach the Desigo CC server

bash

# Example iptables rule restricting Desigo CC event port to an approved client subnet
iptables -A INPUT -p tcp --dport 4998 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4998 -j DROP