Out-of-bounds write in Siemens products - CVE-2021-44018
Published: February 11, 2022 / Updated: February 16, 2022
Vulnerability identifier: #VU60537
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-44018
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in the lmxmlAdapterSE70.dll library. A remote attacker can create a specially crafted PAR file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.
Affected software
JT2Go
Teamcenter Visualization
Solid Edge SE2021
Solid Edge SE2022
Teamcenter Visualization
Solid Edge SE2021
Solid Edge SE2022
How to mitigate CVE-2021-44018
Install updates from vendor's website.
Teamcenter Visualization - update to 13.3.0.1
Solid Edge SE2021 - update to SE2021MP9
Solid Edge SE2022 - update to SE2022MP1
Solid Edge SE2021 - update to SE2021MP9
Solid Edge SE2022 - update to SE2022MP1