Use-After-Free Vulnerability in NX 1980 Series and Solid Edge SE2021 by Siemens
CVE-2021-37202

7.8HIGH

Key Information:

Vendor

Siemens
Status
Nx 1980 Series
Solid Edge Se2021
Vendor
CVE Published:
14 September 2021

What is CVE-2021-37202?

A use-after-free vulnerability exists in the IFC adapter of the NX 1980 Series and Solid Edge SE2021. This vulnerability can be exploited when handling specially crafted IFC files, potentially allowing an attacker to execute arbitrary code within the application's process context. Users are advised to update to the latest versions to mitigate the risk associated with this security flaw.

Affected Version(s)

NX 1980 Series All versions < V1984

Solid Edge SE2021 All versions < SE2021MP8

References

https://cert-portal.siemens.com/productcert/pdf/ssa-20853...
x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/ssa-72861...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.