CISA Issues Advisory on Siemens Desigo CC and Gridscale Products Affected by Critical Brotli Vulnerability
The advisory details how a critical out-of-bounds write vulnerability in the Brotli decoder, tracked as CVE-2026-111497 and nicknamed Node2Shell, impacts multiple Siemens industrial products. Originally disclosed by the Node.js project on October 21, 2026, the flaw resides in Google Brotli versions 1.0.3 through 1.2.0 and can lead to memory corruption, sensitive data disclosure, denial of service, or arbitrary code execution. Affected Siemens offerings include all versions of Desigo CC family V8 and V9, Gridscale X DSA versions from 5.3 up to but not including 5.4, and Gridscale X PSS®E versions below 36.8.0. Siemens has issued remediation guidance recommending installation of the latest .NET security updates or product version upgrades to V5.4 and V36.8.0 respectively. The vulnerability carries a CVSS v3.1 base score of 9.8 and affects critical infrastructure sectors worldwide, including energy and manufacturing. CISA republished the Siemens ProductCERT advisory to increase visibility while emphasizing network segmentation, VPN usage, and pre-deployment validation of patches.
CISA AlertsNov 12, 2026Translated from English