OTPulse
FeedAboutContact

Multiple PAR and DFT File Parsing Vulnerabilities in Solid Edge

Plan Patch7.8SSA-574442Apr 13, 2021
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Multiple vulnerabilities in Solid Edge file parsing for PAR and DFT file formats can be triggered when a user opens a malicious file. These vulnerabilities could cause application crashes or lead to arbitrary code execution on the affected workstation. The vulnerabilities stem from improper memory handling and file validation (CWE-822, CWE-787, CWE-121).

What this means
What could happen
An attacker could craft a malicious PAR or DFT file that, when opened in Solid Edge, executes arbitrary code on the engineering workstation or crashes the application, potentially disrupting design work and compromising system integrity.
Who's at risk
Engineering teams and CAD operators who use Solid Edge for design work on industrial equipment, infrastructure designs, or component modeling. This affects any workstation running Solid Edge SE2020 or SE2021 versions prior to the listed maintenance packs.
How it could be exploited
An attacker creates a malicious Solid Edge file (PAR or DFT format) and tricks a user into opening it. When Solid Edge parses the file, memory corruption or improper file handling allows the attacker to execute arbitrary commands on the workstation with the user's privileges.
Prerequisites
  • User must open a malicious PAR or DFT file in Solid Edge
  • No special credentials or network access required
Low complexity exploitationUser interaction requiredAffects engineering workstationsPotential for arbitrary code execution
Exploitability
Low exploit probability (EPSS 0.7%)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
Solid Edge SE2020< SE2020MP13SE2020MP13
Solid Edge SE2021All Versions < SE2021MP4SE2021MP4
Solid Edge SE2020< SE2020MP14SE2020MP13
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDInstruct users to avoid opening PAR and DFT files from untrusted or unknown sources
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Solid Edge SE2020
HOTFIXUpdate Solid Edge SE2020 to MP13 or later
Solid Edge SE2021
HOTFIXUpdate Solid Edge SE2021 to MP4 or later
View full Siemens ProductCERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/a323b5a1-58dc-4db8-bd58-aa0f72b5c4d1
Multiple PAR and DFT File Parsing Vulnerabilities in Solid Edge | CVSS 7.8 - OTPulse