CVE-2021-41538
Low
Description
A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).
SeverityLow
CVSS3.3
Exploit probability—
ProductSiemens Solid Edge
PublishedSep 28, 2021
First seenSep 28, 2021
Weakness typeCWE-824CWE-824
How to fix
Update
- siemens solid_edgese2021 or later
- siemens nx_1984_firmware1984 or later
- siemens nx_1988_firmware1984 or later
- siemens nx_1957_firmware1973.3700 or later
- siemens nx_1961_firmware1973.3700 or later
- siemens nx_1965_firmware1973.3700 or later
- siemens nx_1969_firmware1973.3700 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens solid_edge | v < se2021, se2021 | se2021 |
| siemens nx_1984_firmware | v < 1984 | 1984 |
| siemens nx_1988_firmware | v < 1984 | 1984 |
| siemens nx_1957_firmware | v < 1973.3700 | 1973.3700 |
| siemens nx_1961_firmware | v < 1973.3700 | 1973.3700 |
| siemens nx_1965_firmware | v < 1973.3700 | 1973.3700 |
| siemens nx_1969_firmware | v < 1973.3700 | 1973.3700 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.