File Parsing Vulnerabilities in Parasolid

An attacker could execute arbitrary code on an engineering workstation running Parasolid by tricking a user into opening a malicious X_T format file. This could give the attacker access to CAD designs, process modifications, or the ability to alter component models used in production.

Engineering and design teams at manufacturing companies using Siemens Parasolid for CAD modeling. This includes facilities that use Parasolid as the solid modeling kernel in NX, Solid Edge, or other Siemens design software. Manufacturing, automotive, aerospace, and equipment OEMs are most at risk.

An attacker creates a malicious X_T format file containing out-of-bounds read/write payloads. The file is sent to a Parasolid user (engineer or designer) via email or shared drive. When the user opens the file in Parasolid, the parsing vulnerability triggers and executes arbitrary code in the context of the engineering workstation process. From there, the attacker could steal design data, modify CAD models, or pivot to other systems on your engineering network.