Description Preview
A critical vulnerability (CVE-2020-28381) has been identified in Siemens Solid Edge SE2020 and SE2021 that could allow remote code execution. The vulnerability stems from improper validation of user-supplied data when parsing PAR files, which can result in an out-of-bounds write into uninitialized memory. This buffer overflow vulnerability (CWE-787) could be exploited by an attacker to execute arbitrary code in the context of the current process, potentially leading to full system compromise.
Overview
The vulnerability affects Siemens Solid Edge SE2020 (all versions prior to SE2020MP12) and Solid Edge SE2021 (all versions prior to SE2021MP2). When processing specially crafted PAR files, the application fails to properly validate user input, leading to a memory corruption vulnerability. An attacker could exploit this by convincing a user to open a malicious PAR file, which would trigger the vulnerability and potentially allow code execution with the same privileges as the application. This is particularly concerning in industrial environments where Solid Edge is commonly used for computer-aided design (CAD).
Remediation
Users should immediately update to the following fixed versions:
- Solid Edge SE2020: Update to SE2020MP12 or later
- Solid Edge SE2021: Update to SE2021MP2 or later
If immediate patching is not possible, consider the following mitigations:
- Avoid opening PAR files from untrusted sources
- Implement network segmentation to restrict access to systems running vulnerable Solid Edge versions
- Use the principle of least privilege for users working with Solid Edge
- Consider using application whitelisting to prevent execution of unauthorized code
References
- Siemens Security Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
- CISA ICS Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04
- Zero Day Initiative Advisory ZDI-21-048: https://www.zerodayinitiative.com/advisories/ZDI-21-048/
- Zero Day Initiative Advisory ZDI-21-053: https://www.zerodayinitiative.com/advisories/ZDI-21-053/
- Zero Day Initiative Advisory ZDI-21-074: https://www.zerodayinitiative.com/advisories/ZDI-21-074/
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
