OTPulse
FeedAboutContact

Multiple PAR File Parsing Vulnerabilities in Solid Edge

Plan Patch7.8SSA-589891Jan 9, 2024
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Solid Edge SE2023 versions prior to V223.0 Update 10 contain multiple vulnerabilities in PAR file parsing. When a user opens a malicious PAR file, memory corruption vulnerabilities (buffer overflow, out-of-bounds read/write) can be triggered. This could result in application crashes or arbitrary code execution on the workstation running Solid Edge.

What this means
What could happen
A user tricked into opening a malicious PAR file in Solid Edge could experience an application crash or potentially allow an attacker to execute arbitrary code on the engineering workstation with the user's privileges.
Who's at risk
Engineering design teams and CAD operators using Solid Edge SE2023 for product design and simulation. This affects any organization using this Siemens software for mechanical design, particularly where files are shared across teams or with external partners.
How it could be exploited
An attacker sends a crafted PAR file to an employee and tricks them into opening it with Solid Edge. The malicious file triggers a memory corruption vulnerability (buffer overflow or out-of-bounds write) in the PAR file parser, causing either a denial of service or code execution on the workstation.
Prerequisites
  • User interaction required: victim must open the malicious PAR file in Solid Edge
  • Solid Edge SE2023 version earlier than V223.0 Update 10 must be installed
  • Attacker must deliver the malicious file via email, file share, or social engineering
user interaction requiredlow complexity exploitationmemory corruption vulnerabilityaffects engineering workstations
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (1)
ProductAffected VersionsFix Status
Solid Edge SE2023All versions < V223.0 Update 10223.0 Update 10
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Solid Edge SE2023 to V223.0 Update 10 or later
View full Siemens ProductCERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/f3417617-747b-4ed3-80e7-29100eb8cd8d