CVE-2021-41538

A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).

CVSS v3 3.3 LOW
CVSS v2.0 4.3 MEDIUM

3.3^/10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf	Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf	Patch Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1122/	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:solid_edge::::::::
	cpe:2.3:a:siemens:solid_edge:se2021:-::::::
	cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1::::::
	cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2::::::
	cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3::::::
	cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4::::::
	cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack5::::::
	cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack6::::::
	cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack7::::::

Configuration 2 (hide)

AND

cpe:2.3:o:siemens:nx_1984_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:nx_1984:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:siemens:nx_1988_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:nx_1988:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:siemens:nx_1957_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:nx_1957:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:siemens:nx_1961_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:nx_1961:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:siemens:nx_1965_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:nx_1965:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:siemens:nx_1969_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:nx_1969:-:*:*:*:*:*:*:*

History

28 Nov 2021, 23:29

Type	Values Removed	Values Added
References	~~(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf -~~	(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf - Patch, Vendor Advisory
CPE		cpe:2.3:h:siemens:nx_1969:-:::::::* cpe:2.3:h:siemens:nx_1961:-:::::::* cpe:2.3:h:siemens:nx_1984:-:::::::* cpe:2.3:h:siemens:nx_1988:-:::::::* cpe:2.3:o:siemens:nx_1961_firmware:::::::: cpe:2.3:h:siemens:nx_1965:-:::::::* cpe:2.3:h:siemens:nx_1957:-:::::::* cpe:2.3:o:siemens:nx_1984_firmware:::::::: cpe:2.3:o:siemens:nx_1965_firmware:::::::: cpe:2.3:o:siemens:nx_1988_firmware:::::::: cpe:2.3:o:siemens:nx_1969_firmware:::::::: cpe:2.3:o:siemens:nx_1957_firmware::::::::

17 Nov 2021, 22:19

Type	Values Removed	Values Added
Summary	A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).	A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).
References		(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf -

17 Nov 2021, 15:15

Type	Values Removed	Values Added
CPE	cpe:2.3:a:siemens:nx_1980:::::::: cpe:2.3:a:siemens:nx_1953::::::::

10 Nov 2021, 01:19

Type	Values Removed	Values Added
References	{'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf', 'name': 'https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'MISC'}
Summary	A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).	A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).

09 Nov 2021, 19:50

Type	Values Removed	Values Added
References	~~(MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1122/ - Third Party Advisory~~	(MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1122/ - Third Party Advisory, VDB Entry
References	~~(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf -~~	(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf - Patch, Vendor Advisory
CPE		cpe:2.3:a:siemens:nx_1980:::::::: cpe:2.3:a:siemens:nx_1953::::::::

09 Nov 2021, 12:15

Type	Values Removed	Values Added
Summary	A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).	A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 (All versions < SE2021MP8). The affected application is vulnerable to information disclosure by unexpected access to an uninitialized pointer while parsing user-supplied OBJ files. An attacker could leverage this vulnerability to leak information from unexpected memory locations (ZDI-CAN-13770).
References		(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf -

01 Oct 2021, 13:53

Type	Values Removed	Values Added
CPE		cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:::::: cpe:2.3:a:siemens:solid_edge:se2021:-:::::: cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:::::: cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:::::: cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack6:::::: cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack5:::::: cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack7:::::: cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:::::: cpe:2.3:a:siemens:solid_edge::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 4.3 v3 : 3.3
References	~~(MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1122/ -~~	(MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1122/ - Third Party Advisory
References	~~(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf -~~	(MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf - Patch, Vendor Advisory

30 Sep 2021, 16:15

Type	Values Removed	Values Added
References		(MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1122/ -

28 Sep 2021, 12:22

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-09-28 12:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-41538

Mitre link : CVE-2021-41538

CVE.ORG link : CVE-2021-41538

JSON object : View

Products Affected

siemens

nx_1961
solid_edge
nx_1984
nx_1957_firmware
nx_1957
nx_1984_firmware
nx_1965
nx_1988_firmware
nx_1965_firmware
nx_1969_firmware
nx_1961_firmware
nx_1988
nx_1969

CWE

CWE-824

Access of Uninitialized Pointer

3.3 /10

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

JSON object

Attach tags to CVE-2021-41538

3.3^/10

4.3^/10

Attach tags to `CVE-2021-41538`