Remote Code Execution Vulnerability in SAP 3D Visual Enterprise Viewer
CVE-2022-41189

7.8HIGH

Key Information:

Vendor
SAP
Status
SAP 3d Visual Enterprise Viewer
Vendor
CVE Published:
11 October 2022

Summary

A security issue exists in SAP 3D Visual Enterprise Viewer version 9 due to inadequate memory management. When users open a specially crafted AutoCAD (.dwg) file using TeighaTranslator.exe, it can lead to a stack-based overflow or re-use of a dangling pointer. This manipulation may result in the execution of arbitrary code, potentially allowing an attacker to take control of the user's system. Users are advised to ensure files are from trusted sources and monitor updates from SAP for any patches that mitigate this risk.

Affected Version(s)

SAP 3D Visual Enterprise Viewer 9

References

https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...
https://launchpad.support.sap.com/#/notes/3245928

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.