Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll from a remote network share. As a result, the .dll entry point can be executed without sufficient UI warning.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdf | Third Party Advisory |
| https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01 | Third Party Advisory US Government Resource |
| https://www.zerodayinitiative.com/advisories/ZDI-21-323/ | Third Party Advisory VDB Entry |
| https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdf | Third Party Advisory |
| https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01 | Third Party Advisory US Government Resource |
| https://www.zerodayinitiative.com/advisories/ZDI-21-323/ | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
History
No history.
Information
Published : 2021-02-23 04:15
Updated : 2024-11-21 05:50
NVD link : CVE-2021-22645
Mitre link : CVE-2021-22645
CVE.ORG link : CVE-2021-22645
JSON object : View
Products Affected
siemens
- solid_edge_se2021_firmware
- solid_edge_se2021
- solid_edge_se2020_firmware
- solid_edge_se2020
luxion
- keyshot_network_rendering
- keyshot
- keyvr
- keyshot_viewer
CWE