--- schema: 1 kind: vulnerability title: "CVE-2026-111497, Brotli decoder flaw in Siemens Desigo CC and Industrial Edge, Mitel MiVoice Business and OpenScape, with Cisco listing Duo Network Gateway and RoomOS in its combined advisory: Desigo CC takes the .NET updates, while Mitel updates and the Industrial Edge Common Configurator fix are still pending" headline: "Brotli flaw hits Desigo CC, Industrial Edge and Mitel; Cisco lists Duo; Mitel and Common Configurator fixes pending" summary: > Between 2026-10-27 and 2026-11-06 Siemens, Mitel and Cisco listed affected products in advisories that cover the Brotli decoder flaw CVE-2026-111497: Siemens names Desigo CC V8 and V9 (remedy: the latest .NET security updates) and Industrial Edge, where Common Configurator has no fix; Mitel names MiVoice Business and five OpenScape products with updates planned and workaround articles for three; Cisco's combined advisory lists Duo Network Gateway (3.4.2) and RoomOS among its products with fixes, a longer list of which is dated up to 2027, without saying which of its CVEs each fix addresses. Cisco says it is not aware of malicious use against any Cisco product, and CISA lists the flaw as exploited. discovered_at: "2026-11-07T03:58:30Z" updated_at: null event_date: "2026-11-06" run_id: 2026-11-07T0256Z-intel priority: notable immediate_action: null tags: [vulnerabilities, rce, pre-auth, actively-exploited, cisa-kev, poc-public, patch-available, no-patch] regions: [global] sectors: [public-sector] entities: ["product:siemens-desigo-cc", "product:siemens-industrial-edge", "product:mitel-mivoice-business", "product:mitel-openscape-sbc", "product:mitel-openscape-contact-center", "product:cisco-roomos"] techniques: [T1190] affected_products: ["Siemens Desigo CC", "Siemens Industrial Edge", "Mitel MiVoice Business", "Mitel OpenScape SBC", "Mitel OpenScape Contact Center", "Cisco Duo Network Gateway", "Cisco RoomOS"] cves: - id: CVE-2026-111497 cvss: "9.8 (CVSS 3.1, Siemens)" epss: null type: memory-corruption vector: zero-click auth: pre-auth status: [exploited, cisa-kev, poc-public, patch-available, no-patch] affected: "Siemens Desigo CC V8 and V9, all versions; Industrial Edge Management Applications, Common Configurator and the configurator applications below their fixed versions; Mitel MiVoice Business 10.6.0.7 and earlier, MiVoice Business Solution Virtual Instance up to the build Mitel lists, OpenScape SBC V11R3.4.4 and earlier, OpenScape SESAP V2 R1.1.9 and earlier, OpenScape Contact Center V12R0 to V12R0FR7, OpenScape Xpert V9 R0.2.0 and earlier, OpenScape Endpoint Management V1 R2.5.1 and earlier; Cisco Duo Network Gateway and RoomOS, which Cisco's combined advisory lists in a table with no per-CVE column, below the builds it lists" fixed: "Desigo CC: latest .NET security updates via Windows Update; Industrial Edge: Data Flow Monitoring V3.0.18, Flow Creator Configurator V1.15.1 and four further configurators, Common Configurator no fix; Mitel: updates planned (OpenScape SBC V11R3.4.5, SESAP V2 R1.1.10, Contact Center V12R0FR8), none released; Cisco: fixes listed in its combined advisory for Duo Network Gateway 3.4.2 and RoomOS on-premises 11.41.2.3 and 26.7.4.3, not tied to one CVE" sources: - url: "https://cert-portal.siemens.com/productcert/html/ssa-045512.html" publisher: "Siemens ProductCERT (SSA-045512)" date: "2026-10-30" role: primary - url: "https://cert-portal.siemens.com/productcert/html/ssa-443410.html" publisher: "Siemens ProductCERT (SSA-443410)" date: "2026-10-30" role: primary - url: "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2026-0010" publisher: "Mitel (MISA-2026-0010)" date: "2026-10-28" role: primary - url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u" publisher: "Cisco PSIRT" date: "2026-10-27" role: primary - url: "https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog" publisher: "CISA" date: "2026-10-27" role: corroborating closed_sources: [] evidence: - quote: "The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities described in this advisory." publisher: "Cisco PSIRT" source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u" - quote: "Install the latest .NET security updates via Windows Update." publisher: "Siemens ProductCERT" source_url: "https://cert-portal.siemens.com/productcert/html/ssa-045512.html" - quote: "Planned update for V11R3.4.5. Workaround available, see KB article" publisher: "Mitel" source_url: "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2026-0010" verification: multi-source sourcing_note: > Each vendor is the authority for its own products, and the lists are as of the dates read; the exploited status comes from CISA's catalog listing of the flaw, and Cisco says it is not aware of malicious use against any Cisco product: Cisco's advisory is revised often and its fix table does not say which listed fixes are released and which planned, Mitel's rev 5.0 lists several products as still under investigation, and Siemens' Industrial Edge advisory says it is still assessing impact. The CVSS 3.1 score of 9.8 is Siemens'; Mitel rates the flaw 8.1 for its products and Cisco gives this CVE no score of its own, and the Mitel KB articles are behind a login and were not read. confidence: high references: - 2026-10-24/cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi - 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Install the latest .NET security updates through Windows Update on every Siemens Desigo CC V8 and V9 host." - "On every Industrial Edge Management instance running Common Configurator, uninstall all Management Applications and put the instance behind a firewall or WAF, and stop Common Configurator on Edge devices, until Siemens ships a fix, because Siemens lists no fix for it." - "Apply Mitel's workaround articles KB000129034 (OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center) on the OpenScape SESAP, SBC and Contact Center systems in use, because Mitel has released no update for them." updates: [] migrated_from: null --- The Brotli decoder flaw CVE-2026-111497 is an out-of-bounds write caused by improper handling of malformed compressed data ([Mitel, 2026-10-28](https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2026-0010)), and CISA lists it as exploited ([CISA, 2026-10-27](https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog)). Siemens' advisory SSA-045512, revised on 2026-11-06, lists Desigo CC V8 and V9, all versions, remedied by installing the latest .NET security updates via Windows Update, and scores the flaw CVSS 3.1 9.8 ([Siemens ProductCERT, 2026-10-30](https://cert-portal.siemens.com/productcert/html/ssa-045512.html)). Its Industrial Edge advisory SSA-443410 says an Industrial Edge Management setup with no Management Applications installed needs no action because the affected functionality is not used or exposed, gives fixed versions for six configurator and monitoring applications, and for Common Configurator, which has no fix, says to uninstall all Management Applications and protect the instance with a firewall or WAF, or on a device to stop the application, until a fix is available ([Siemens ProductCERT, 2026-10-30](https://cert-portal.siemens.com/productcert/html/ssa-443410.html)). Mitel's MISA-2026-0010, revision 5.0 of 2026-11-04, rates the flaw high (CVSS 3.1 8.1) and lists MiVoice Business 10.6.0.7 and earlier, its Solution Virtual Instance up to the build in Mitel's table, OpenScape SBC V11R3.4.4 and earlier, OpenScape SESAP V2 R1.1.9 and earlier, OpenScape Contact Center V12R0 to V12R0FR7, OpenScape Xpert V9 R0.2.0 and earlier and OpenScape Endpoint Management V1 R2.5.1 and earlier as affected; for each an update is planned, not released, and workaround articles exist for OpenScape SBC, SESAP and Contact Center ([Mitel, 2026-10-28](https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2026-0010)). Mitel rates the risk low for MiVoice Business, Xpert and Endpoint Management when deployed according to its guidelines, and still lists several products as under investigation ([Mitel, 2026-10-28](https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2026-0010)). Cisco's advisory, version 1.8 of 2026-11-06 and revised often, says its PSIRT is aware that proof-of-concept exploit code is available and is not aware of any malicious use against any Cisco product; it lists Catalyst SD-WAN, IOS XE, IOS XR and Secure Firewall ASA, FMC and FTD as not impacted and Identity Services Engine as under investigation ([Cisco PSIRT, 2026-10-27](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u)). Its one fix table for the advisory's four CVEs, with no column for which CVE a fix addresses, lists Duo Network Gateway (3.4.2), Spaces (24.22.1), RoomOS on Board, Desk and Room Series devices (on-premises 11.41.2.3 and 26.7.4.3) and a longer list whose fixes are dated November 2026 to July 2027 ([Cisco PSIRT, 2026-10-27](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u)). **Exposure:** a Desigo CC host, an Industrial Edge Management instance with Management Applications installed or a Common Configurator on an Edge device, a Mitel MiVoice Business or OpenScape system at the listed versions, or a Cisco Duo Network Gateway or RoomOS device that Cisco lists in its combined advisory, below the builds above. Mitel says the impact on its products may differ from its rating because of product architecture ([Mitel, 2026-10-28](https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2026-0010)), so the vendor tables are the check. **Defender takeaway:** install the current .NET updates on every Desigo CC host. On Industrial Edge, update the monitoring and configurator applications to the fixed versions and, where Common Configurator runs, uninstall all Management Applications or stop it on Edge devices until Siemens ships a fix. Apply Mitel's workaround articles for OpenScape SBC, SESAP and Contact Center while no update is released, update Duo Network Gateway to the 3.4.2 that Cisco's table lists, and re-read Cisco's advisory, revised often, before relying on a fix date; Cisco says it is not aware of malicious use against its products, while CISA lists the flaw as exploited.