CVE-2021-22645: Siemens Solid Edge Viewer Insufficient UI Warning Remote Code Execution Vulnerability
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll from a remote network share. As a result, the .dll entry point can be executed without sufficient UI warning.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Solid Edge Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of BIP files. The user interface does not provide sufficient indication of a hazard. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-22645?
CVE-2021-22645 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Siemens Solid Edge Viewer.
How severe is CVE-2021-22645?
CVE-2021-22645 has a severity score of 7.8, which is considered high.
What software is affected by CVE-2021-22645?
Siemens Solid Edge Viewer, Luxion KeyShot, Luxion KeyShot Network Rendering, Luxion KeyShot Viewer, Luxion KeyVR, Siemens Solid Edge Se2020 Firmware, and Siemens Solid Edge Se2021 Firmware are all affected by CVE-2021-22645.
How can CVE-2021-22645 be exploited?
To exploit CVE-2021-22645, user interaction is required, such as visiting a malicious page or opening a malicious file.
Where can I find more information about CVE-2021-22645?
You can find more information about CVE-2021-22645 in the references provided: https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdf, https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01, https://www.zerodayinitiative.com/advisories/ZDI-21-323/