Skip to content
OpenAdvisories
Critical 1 exploited CVE SSA-045512 1 CVE

SSA-045512: Node2Shell Vulnerability in Siemens Products

Published Oct 30, 2026 · Updated Nov 6, 2026 · Revision 3

Vendor: Siemens Product: Desigo CC family V8 Product: Desigo CC family V9 Product: Gridscale X DSA Product: Gridscale X PSS®E Product: Heliox Dual Port 60kW Product: Heliox Flex Pro Product: SICHARGE FLEX Product: SICHARGE UC Product: Sifinity Go Product: Sifinity Setup Product: VersiCharge AC Series Product: VersiCloud

Summary

On October 21, 2026, the Node.js project released security updates addressing a critical vulnerability in the Brotli decoder bundled with Node.js, commonly referred to as "Node2Shell" (tracked as CVE-2026-111497). The vulnerability is an out-of-bounds write that could allow a remote attacker to cause memory corruption and potentially execute arbitrary code. This advisory covers the status of impact of various Siemens software products.

Siemens has released new versions for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026

Revision history

  1. #3

    Added Gridscale X DSA and PSSE to the list of affected products

  2. #2

    Added Desigo CC to the affected products list.

  3. #1

    Publication Date

References