Arbitrary file writes via embedded graphics scripts

Code injection in Siemens Desigo CC V6 and V7 clients allows attackers to write arbitrary files through a malicious graphics document. The client executes unvalidated commands from scripts embedded in user-defined graphics documents when the document is displayed. Exploitation requires an attacker-crafted document and interaction from a sufficiently privileged user; resulting file writes can compromise the client host.