Home / Items
Vendor advisoryKnown exploitedSeverity 9.8 criticalExploit likelihood 83%
SSA-045512: Node2Shell Vulnerability in Siemens Products
SSA-045512 · Siemens · October 30, 2026
Summary
On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens software products.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
From Siemens (vendor's own words, quoted), quoted as published. Check the source before acting.
What to do
Update to V36.8.0 or later version
Update to V5.4 or later version
Install the latest .NET security updates via Windows Update.
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-111497 | 9.8 critical | Exploited | 82.6% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Siemens | Desigo CC family V8 |
| Siemens | Desigo CC family V9 |
| Siemens | Gridscale X DSA |
| Siemens | Gridscale X PSS®E |
| Siemens | Heliox Dual Port 60kW |
| Siemens | Heliox Flex Pro |
| Siemens | SICHARGE FLEX |
| Siemens | SICHARGE UC |
| Siemens | Sifinity Go |
| Siemens | Sifinity Setup |
| Siemens | VersiCharge AC Series |
| Siemens | VersiCloud |
Why it's on these mode pages
- Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
- Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Change history
- October 30, 2026: Publication Date
- November 4, 2026: Added Desigo CC to the affected products list.
- November 6, 2026: Added Gridscale X DSA and PSSE to the list of affected products
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com