CVE-2020-28385: siemens solid_edge Out-of-bounds Write
Vulnerability summary
CVE-2020-28385 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in siemens solid_edge. EPSS estimates a 2.61% chance of exploitation in the next 30 days, higher than 85.1% of scored vulnerabilities.
Timeline
- 15-03-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12049)
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.61%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
+1.13 pp
From 1.48% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Siemens3 products
- solid_edge< se2020 | se2020 | se2020:maintenance_pack1 | se2020:maintenance_pack10 | se2020:maintenance_pack11 | se2020:maintenance_pack12 | se2020:maintenance_pack2 | se2020:maintenance_pack3 | se2020:maintenance_pack4 | se2020:maintenance_pack5 | se2020:maintenance_pack6 | se2020:maintenance_pack7 | se2020:maintenance_pack8 | se2020:maintenance_pack9 | se2021 | se2021:maintenance_pack1 | se2021:maintenance_pack2 | se2021:maintenance_pack3
- solid_edge_se2020_firmwareAll versions < SE2020MP13
- solid_edge_se2021_firmwareAll Versions < SE2021MP4
1 vendor · 3 products
References
3 links
us-cert.cisa.gov/ics/advisories/icsa-21-103-06X Refsource CONFIRMThird Party AdvisoryUS Government Resource