CVE-2021-25678: siemens solid_edge_se2020_firmware Out-of-bounds Write

Vulnerability summary

CVE-2021-25678 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in siemens solid_edge_se2020_firmware. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.7% of scored vulnerabilities.

Timeline

1. 22-04-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions < SE2020MP14), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12529)

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.