Description

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded within user-defined graphics documents. Specifically, when the script within a graphics document is designed or modified by an attacker to include malicious commands. When a user opens a compromised graphics document, the embedded script is executed on the client application instance, allowing an attacker to write arbitrary files to the client's operating system. Successful exploitation requires an attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. This could lead to compromise of the client operating system and potential lateral movement within the organization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-08T09:18:00.373Z",
  "pubdate": "2026-09-08T09:18:00.373Z",
  "executiveSummary": "A critical Client Code Execution (CCE) vulnerability has been identified within multiple versions of the Desigo CC product family, including ClickOnce, Flex, and Installed clients. The vulnerability stems from improper input validation regarding scripts embedded within user-defined graphics documents.\nBy manipulating the script content of these graphics documents, an unauthenticated attacker can execute arbitrary code on the client machine when a legitimate user opens the compromised file. This flaw permits the unauthorized writing of files to the underlying operating system.\nThe successful exploitation of this vulnerability poses a significant risk to the integrity and availability of the host client environment. It facilitates potential full system compromise and serves as a vector for lateral movement within the broader organizational network.\nExploitation requires that an attacker crafts a malicious graphics document and successfully social engineers a user with appropriate privileges to open the document within the affected Desigo CC client instance. No direct network access to the target is required if the malicious file is delivered and accessed locally or via a shared resource.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the Desigo CC client-side input validation mechanism. Specifically, the application's graphics document rendering engine does not sufficiently sanitize or restrict the execution context of scripts embedded within user-defined graphic files.\nWhen a graphics document is processed, the application parses the embedded script logic. Because the validation routines do not differentiate between benign operational scripts and malicious commands, the client engine treats attacker-supplied code as trusted instructions.\nThe attack flow commences when an attacker embeds malicious code into a graphics document object. This document is then distributed to a victim, typically via social engineering tactics such as phishing or by placing the file in a shared directory that a privileged user is likely to access.\nUpon the user opening the compromised graphics document in a vulnerable Desigo CC client instance (including versions of Desigo CC ClickOnce Client V6/V7, Desigo CC family V8/V9, Desigo CC Flex Client V6/V7, and Desigo CC Installed Client V6/V7), the rendering engine executes the embedded script in the context of the user process.\nThe execution allows for unauthorized interactions with the local operating system, most notably the capability to write arbitrary files to the filesystem. This can be used to drop persistent malware, overwrite system configurations, or deploy binaries that facilitate further compromise.\nSince the script executes with the privileges of the logged-in user, the impact is strictly governed by the local system's permission model. If the Desigo CC client is running with administrative or service-level privileges, the attacker gains those same privileges, allowing for full system takeover and the potential to pivot into internal segments of the network infrastructure.\nThere is no requirement for prior authentication to the Desigo CC server, as the vulnerability is triggered by the client-side parsing of the document. The exposure is effectively unlimited, provided the attacker can convince a user to interact with the malicious document file."
}