PT-2021-19991 · Unknown · Drawings Sdk

Mat Powell · Published 2021-06-17 · Updated 2023-02-09 · CVE-2021-32946

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drawings SDK versions 2022.4 and prior

Description The issue exists within the parsing DGN files from Drawings SDK, resulting from the lack of proper validation of the user-supplied data. This may result in out-of-bounds problems and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.

Recommendations For Drawings SDK versions 2022.4 and prior, consider disabling the DGN file parsing functionality until a patch is available. Restrict access to the Drawings SDK to minimize the risk of exploitation. Avoid using the Drawings SDK to parse DGN files from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2021-32946

ZDI-21-983

ZDI-21-985

ZDI-23-130

Affected Products

Drawings Sdk

References · 11

• https://osv.dev/vulnerability/CVE-2021-32946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32946 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf · Patch
• https://zerodayinitiative.com/advisories/ZDI-21-983 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-985 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-130 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02 · Note
• https://t.me/cvenotify/16510 · Telegram Post
• https://t.me/cibsecurity/25515 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-938030.pdf · Note
• https://t.me/echeloneyes/822 · Telegram Post