File Parsing Vulnerability in Solid Edge

An attacker could trick an engineer or CAD operator into opening a malicious design file, allowing the attacker to run code on the engineering workstation with that user's privileges. This could lead to theft of design data, modification of CAD models, or lateral movement into the plant network.

Solid Edge is used by manufacturing and process engineering teams for CAD design and 3D modeling. This affects engineering workstations at utilities with generation, transmission, or distribution facilities that use Siemens design tools for equipment specification, control system design, or plant layout work.

An attacker sends a malicious Solid Edge file (.asm, .par, or other format) containing a specially crafted XT part to an engineer via email or file sharing. When the engineer opens the file in Solid Edge, the out of bounds read is triggered during file parsing, allowing the attacker to achieve code execution on the workstation.