Login Request a demo
High severity · published Aug 10, 2021
CVE-2021-37180
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7)
7.8
CVSS
1.4%
EPSS
No
On KEV
Description
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks proper validation while parsing user-supplied OBJ files that could cause an out of bounds access to an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13775)
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Solid Edge Se2021 Firmware · Siemens
before se2021mp7 · source: NVD
Affected product
SE
Solid Edge Se2021 Firmware
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-37180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-37180
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1113/
More from Solid Edge Se2021 Firmware
8.8
CVE-2021-31343
The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when…
8.8
CVE-2021-31342
The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data…
7.8
CVE-2021-37179
A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7)
7.8
CVE-2021-27490
Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior are vulnerable to an out-of-bounds…
7.8
CVE-2021-27496
Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior lack proper validation of user-supplied…