CVE-2021-37202

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The IFC adapter in affected application contains a use-after-free vulnerability that could be triggered while parsing user-supplied IFC files. An attacker could leverage this vulnerability to execute code in the context of the current process.

Se ha identificado una vulnerabilidad en NX 1980 Series (Todas las versiones anteriores a V1984), Solid Edge SE2021 (Todas las versiones anteriores a SE2021MP8). El adaptador IFC de la aplicación afectada contiene una vulnerabilidad de uso después de libre que podría activarse mientras se analizan los archivos IFC suministrados por el usuario. Un atacante podría aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-07-21 CVE Reserved
2021-09-14 CVE Published
2024-08-04 CVE Updated
2024-08-20 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-416: Use After Free

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-208530.pdf	2021-11-18
https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf	2021-11-18

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Siemens Search vendor "Siemens"		Nx 1980 Search vendor "Siemens" for product "Nx 1980"				< 1984 Search vendor "Siemens" for product "Nx 1980" and version " < 1984"		-		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				< se2021 Search vendor "Siemens" for product "Solid Edge" and version " < se2021"		-		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				se2021 Search vendor "Siemens" for product "Solid Edge" and version "se2021"		-		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				se2021 Search vendor "Siemens" for product "Solid Edge" and version "se2021"		maintenance_pack1		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				se2021 Search vendor "Siemens" for product "Solid Edge" and version "se2021"		maintenance_pack2		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				se2021 Search vendor "Siemens" for product "Solid Edge" and version "se2021"		maintenance_pack3		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				se2021 Search vendor "Siemens" for product "Solid Edge" and version "se2021"		maintenance_pack4		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				se2021 Search vendor "Siemens" for product "Solid Edge" and version "se2021"		maintenance_pack5		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				se2021 Search vendor "Siemens" for product "Solid Edge" and version "se2021"		maintenance_pack6		Affected
Siemens Search vendor "Siemens"		Solid Edge Search vendor "Siemens" for product "Solid Edge"				se2021 Search vendor "Siemens" for product "Solid Edge" and version "se2021"		maintenance_pack7		Affected