CVE-2021-37179: Siemens Solid Edge Viewer OBJ File Parsing Use-After-Free Remote Code Execution Vulnerability
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library in affected application lacks proper validation while parsing user-supplied OBJ files that could lead to a use-after-free condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13777)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Solid Edge SE2021to a version that resolves this vulnerability.Fixed in SE2021MP7 - Compensating control
Mitigate by preventing untrusted users from supplying OBJ files to Solid Edge SE2021 (e.g., restrict access to the environment where OBJ files are processed).
Event History
Frequently Asked Questions
What is the vulnerability ID for this Siemens Solid Edge Viewer vulnerability?
The vulnerability ID for this Siemens Solid Edge Viewer vulnerability is CVE-2021-37179.
What is the severity of CVE-2021-37179?
The severity of CVE-2021-37179 is high with a severity value of 7.8.
What is the description of CVE-2021-37179?
CVE-2021-37179 allows remote attackers to execute arbitrary code on affected installations of Siemens Solid Edge Viewer.
Which software is affected by CVE-2021-37179?
Siemens Solid Edge Viewer and Siemens Solid Edge Se2021 Firmware (up to and excluding version se2021mp7) are affected by CVE-2021-37179.
How can CVE-2021-37179 be exploited?
User interaction is required to exploit CVE-2021-37179 by visiting a malicious page or opening a malicious file.