« Volver al listado

CVE-2021-41540

Estado: ModificadaAlta (7.8)—

A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13776).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Siemens — Solid Edge

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-41540",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "Solid Edge SE2021",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < SE2021MP8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-09-28T12:15:08.350",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1124/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1124/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13776)."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Solid Edge SE2021 (Todas las versiones anteriores a SE2021MP8). La aplicación afectada contiene una vulnerabilidad de uso de memoria previamente liberada mientras se analizan archivos OBJ. Un atacante podría explotar esta vulnerabilidad para ejecutar código en el contexto del proceso actual (ZDI-CAN-13776)"
    }
  ],
  "lastModified": "2026-06-17T04:08:36.917",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "576A303A-66CA-4694-AA54-9EB0137C24F1",
              "versionEndExcluding": "se2021"
            },
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39D237BD-EE55-4B40-ABC3-194C4BF7C6CD"
            },
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49F5649A-349C-42C6-AFFF-CEE1ABC14E67"
            },
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "756343AA-DB57-40F7-94FA-84BFCDEB6159"
            },
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36B0DD28-653E-4069-AB5A-38F8EFEB36CA"
            },
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82090774-D894-41C8-82F1-A48A8707E9BB"
            },
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD346D22-9B5D-4A50-94E2-1F5C8D391EC3"
            },
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1466AEE0-4A5C-4E2D-80B8-43680F60FC31"
            },
            {
              "criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4173D09-C317-45FF-ABA4-39E5592862F8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}