PT-2022-6626 · Siemens · Solid Edge

Published 2022-11-21 · Updated 2023-08-08 · CVE-2023-30986

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Solid Edge SE2023 versions prior to V223.0 Update 3

Description A memory corruption issue has been identified in the affected application while parsing specially crafted STP files. This could allow an attacker to execute code in the context of the current process. The vulnerability is related to a buffer overflow in memory when handling STP files, which could also lead to denial of service by opening a maliciously crafted file.

Recommendations For Solid Edge SE2023 versions prior to V223.0 Update 3, update to V223.0 Update 3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of specially crafted STP files until a patch is applied. Restrict access to untrusted STP files to minimize the risk of exploitation.

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2023-02882

CVE-2023-30986

ZDI-23-1023

Affected Products

Solid Edge

References · 7

• https://osv.dev/vulnerability/CVE-2023-30986 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02882 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-30986 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1023 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-932528.pdf · Vendor Advisory
• https://t.me/cibsecurity/63598 · Telegram Post
• https://zerodayinitiative.com/advisories/upcoming · Note