First published: Tue Jan 12 2021(Updated: )
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
Credit: productcert@siemens.com
Affected Software | Affected Version | How to fix |
---|---|---|
Siemens Solid Edge | <se2020 | |
Siemens Solid Edge | =se2020 | |
Siemens Solid Edge | =se2020-maintenance_pack1 | |
Siemens Solid Edge | =se2020-maintenance_pack10 | |
Siemens Solid Edge | =se2020-maintenance_pack11 | |
Siemens Solid Edge | =se2020-maintenance_pack2 | |
Siemens Solid Edge | =se2020-maintenance_pack3 | |
Siemens Solid Edge | =se2020-maintenance_pack4 | |
Siemens Solid Edge | =se2020-maintenance_pack5 | |
Siemens Solid Edge | =se2020-maintenance_pack6 | |
Siemens Solid Edge | =se2020-maintenance_pack7 | |
Siemens Solid Edge | =se2020-maintenance_pack8 | |
Siemens Solid Edge | =se2020-maintenance_pack9 | |
Siemens Solid Edge | =se2021 | |
Siemens Solid Edge | =se2021-maintenance_pack1 | |
Siemens Solid Edge Viewer | ||
Siemens Solid Edge: All versions prior to SE2021MP2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2020-28386 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Siemens Solid Edge Viewer.
To exploit CVE-2020-28386, user interaction is required, such as visiting a malicious page or opening a malicious file.
CVE-2020-28386 has a severity value of 7.8, which is considered high.
Siemens Solid Edge Viewer versions se2020, se2020-maintenance_pack1 to se2020-maintenance_pack11, se2021, and se2021-maintenance_pack1 are affected by CVE-2020-28386.
To mitigate CVE-2020-28386, it is recommended to apply the necessary security patches provided by Siemens.