Siemens NX
Plan Patch7.8ICS-CERT ICSA-21-257-09Sep 14, 2021
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Siemens NX 1980 Series (versions prior to 1984) contains two memory corruption vulnerabilities (use-after-free and buffer over-read, CWE-416 and CWE-125) in the IFC file parser. When a user opens a malicious IFC file, these vulnerabilities can lead to access violations and arbitrary code execution on the host system. The vulnerabilities are not remotely exploitable and require user interaction—specifically, a user must be tricked into opening a crafted file.
What this means
What could happen
An attacker could trick a user into opening a malicious IFC file in Siemens NX, potentially executing arbitrary code on the engineering workstation with the user's privileges.
Who's at risk
This affects engineering teams using Siemens NX design software for CAD modeling and simulation. Any user who receives unsolicited IFC files via email or collaboration platforms is at risk. This is particularly relevant for companies in manufacturing, aerospace, automotive, and infrastructure sectors that rely on NX for product design and process simulation.
How it could be exploited
An attacker sends a specially crafted IFC (Industry Foundation Classes) file to a user and social engineers them into opening it with Siemens NX. When the file is parsed, memory corruption vulnerabilities (use-after-free and buffer over-read) trigger, allowing code execution on the workstation.
Prerequisites
- User must open a malicious IFC file in Siemens NX
- User must be running vulnerable version (NX 1980 Series prior to v1984)
- Local code execution with user privileges only
Local code execution via file parsingSocial engineering required (user must open file)No authentication required to trigger vulnerabilityLow attack complexityAffects engineering workstations with design data access
Exploitability
Low exploit probability (EPSS 0.4%)
Affected products (1)
ProductAffected VersionsFix Status
NX 1980 Series<V19841984
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDDo not open IFC files from unknown or untrusted sources until updated
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Siemens NX to version 1984 or later
Long-term hardening
0/1HARDENINGEducate users on social engineering and phishing risks related to file attachments
CVEs (2)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/13948272-59ee-4b5c-8c2e-557e1b4e6a4f