Sign-up

ID

VAR-202109-1120


CVE

CVE-2021-41537


TITLE

Siemens Solid Edge Viewer OBJ File Parsing Use-After-Free Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-21-1121

DESCRIPTION

A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13789). This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Solid Edge Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of OBJ files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.16

sources: NVD: CVE-2021-41537 // ZDI: ZDI-21-1121 // CNNVD: CNNVD-202104-975 // VULMON: CVE-2021-41537

AFFECTED PRODUCTS

vendor:siemensmodel:solid edgescope:eqversion:se2021

Trust: 1.0

vendor:siemensmodel:solid edgescope:ltversion:se2021

Trust: 1.0

vendor:siemensmodel:solid edge viewerscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-21-1121 // NVD: CVE-2021-41537

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-41537
value: HIGH

Trust: 1.0

ZDI: CVE-2021-41537
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202109-1840
value: HIGH

Trust: 0.6

VULMON: CVE-2021-41537
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-41537
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: CVE-2021-41537
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2021-41537
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-1121 // VULMON: CVE-2021-41537 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202109-1840 // NVD: CVE-2021-41537

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 2.0

sources: NVD: CVE-2021-41537

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202109-1840

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-41537

PATCH
title: - url:https://www.siemens.com/cert/advisories/https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf
Trust: 0.7
title:Siemens Solid Edge Remediation of resource management error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=164368
Trust: 0.6
title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=3b85ee03e935aff52e55e7402b3926a1
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-1121 // 
            
            
            
            VULMON: CVE-2021-41537 // 
            
            
            
            CNNVD: CNNVD-202109-1840

EXTERNAL IDS
db:NVDid:CVE-2021-41537
Trust: 2.4
db:ZDIid:ZDI-21-1121
Trust: 2.4
db:SIEMENSid:SSA-728618
Trust: 1.7
db:ZDI_CANid:ZDI-CAN-13789
Trust: 0.7
db:CS-HELPid:SB2021041363
Trust: 0.6
db:CNNVDid:CNNVD-202104-975
Trust: 0.6
db:ICS CERTid:ICSA-21-287-06
Trust: 0.6
db:CS-HELPid:SB2021092905
Trust: 0.6
db:AUSCERTid:ESB-2021.3454
Trust: 0.6
db:CNNVDid:CNNVD-202109-1840
Trust: 0.6
db:VULMONid:CVE-2021-41537
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-1121 // 
            
            
            
            VULMON: CVE-2021-41537 // 
            
            
            
            CNNVD: CNNVD-202104-975 // 
            
            
            
            CNNVD: CNNVD-202109-1840 // 
            
            
            
            NVD: CVE-2021-41537

REFERENCES
url:https://www.zerodayinitiative.com/advisories/zdi-21-1121/
Trust: 2.4
url:https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf
Trust: 1.7
url:https://www.siemens.com/cert/advisories/https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf
Trust: 0.7
url:https://www.cybersecurity-help.cz/vdb/sb2021041363
Trust: 0.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-287-06
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.3454
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2021-41537
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2021092905
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/416.html
Trust: 0.2
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            ZDI: ZDI-21-1121 // 
            
            
            
            VULMON: CVE-2021-41537 // 
            
            
            
            CNNVD: CNNVD-202104-975 // 
            
            
            
            CNNVD: CNNVD-202109-1840 // 
            
            
            
            NVD: CVE-2021-41537

CREDITS
xina1i
Trust: 1.3
sources:
            
            
            ZDI: ZDI-21-1121 // 
            
            
            
            CNNVD: CNNVD-202109-1840

SOURCES
db:ZDIid:ZDI-21-1121
db:VULMONid:CVE-2021-41537
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202109-1840
db:NVDid:CVE-2021-41537

LAST UPDATE DATE
2022-05-04T07:48:29.675000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-21-1121date:2021-09-30T00:00:00
db:VULMONid:CVE-2021-41537date:2021-10-01T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202109-1840date:2021-10-19T00:00:00
db:NVDid:CVE-2021-41537date:2021-10-01T13:52:00

SOURCES RELEASE DATE
db:ZDIid:ZDI-21-1121date:2021-09-30T00:00:00
db:VULMONid:CVE-2021-41537date:2021-09-28T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202109-1840date:2021-09-28T00:00:00
db:NVDid:CVE-2021-41537date:2021-09-28T12:15:00