OTPulse
FeedAboutContact

X_T File Parsing Vulnerabilities in Parasolid

Plan Patch7.8SSA-222019Apr 9, 2024
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Parasolid is vulnerable to out-of-bounds read, stack exhaustion, and null pointer dereference vulnerabilities triggered when parsing malicious X_T format files. These memory corruption flaws could allow remote code execution in the Parasolid process if a user opens a crafted file. The vulnerabilities affect V35.1 before .254, V36.0 before .207, and V36.1 before .147.

What this means
What could happen
An attacker could execute arbitrary code within Parasolid if an engineer is tricked into opening a malicious X_T design file, potentially compromising design integrity and enabling persistence on engineering workstations.
Who's at risk
Engineering organizations and design teams that use Siemens Parasolid for CAD/CAM work, including aerospace, automotive, industrial equipment, and manufacturing sectors. Affects workstations where engineers design and manipulate 3D models stored in X_T format.
How it could be exploited
An attacker sends or hosts a malicious X_T file and tricks an engineer into opening it with Parasolid. The file triggers out-of-bounds memory reads, stack exhaustion, or null pointer dereference during parsing, allowing code execution within the Parasolid process context.
Prerequisites
  • User interaction required: engineer must open the malicious X_T file in Parasolid
  • Parasolid must be installed and in use on an engineering workstation
  • Vulnerable version must be running (V35.1 before .254, V36.0 before .207, V36.1 before .147)
User interaction required (social engineering)Affects engineering/design workstationsMemory corruption vulnerabilities (out-of-bounds read, null pointer dereference)Remote code execution possible
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
Parasolid V35.1<V35.1.25435.1.254
Parasolid V36.0<V36.0.20736.0.207
Parasolid V36.1<V36.1.14736.1.147
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDImplement file source validation and restrict opening X_T files from untrusted sources until updates are applied
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

Parasolid V35.1
HOTFIXUpdate Parasolid V35.1 to version 35.1.254 or later
Parasolid V36.0
HOTFIXUpdate Parasolid V36.0 to version 36.0.207 or later
Parasolid V36.1
HOTFIXUpdate Parasolid V36.1 to version 36.1.147 or later
View full Siemens ProductCERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/d2961a15-de5c-4561-9357-7159dc932046