CVE-2021-27492

mediumPriorität · verfolgen · 23EPSS 0.017 · 78. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.75% (78th) EPSS

CVSS 4.3 · medium

Is it mine?

19 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-27

When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSolid Edge SE2020siemens_psirt
Update KeyShot V8 (as bundled with SE2020) to V10.2 or later version
https://www.keyshot.com/resources/downloads/
BehobenSolid Edge SE2021siemens_psirt
Update KeyShot V9 (as bundled with SE2021) to V10.2 or later version
https://www.keyshot.com/resources/downloads/
MitigationSolid Edge SE2020siemens_psirt
Avoid to open untrusted files from unknown sources
MitigationSolid Edge SE2021siemens_psirt
Avoid to open untrusted files from unknown sources
MitigationCatiaV5_3dReadcisa_csaf_ot
Datakit has released CrossCAD/Ware library Version 2021.2 and recommends software vendors upgrade to this version or later. Versions 2021.1 or earlier are still affected by the vulnerabilities.
MitigationCatiaV6_3dReadcisa_csaf_ot
Datakit has released CrossCAD/Ware library Version 2021.2 and recommends software vendors upgrade to this version or later. Versions 2021.1 or earlier are still affected by the vulnerabilities.
MitigationJt3dReadPsrcisa_csaf_ot
Datakit has released CrossCAD/Ware library Version 2021.2 and recommends software vendors upgrade to this version or later. Versions 2021.1 or earlier are still affected by the vulnerabilities.
MitigationKeyShotcisa_csaf_ot
Datakit has released CrossCAD/Ware library Version 2021.2 and recommends software vendors upgrade to this version or later. Versions 2021.1 or earlier are still affected by the vulnerabilities.
MitigationStep3dReadcisa_csaf_ot
Datakit has released CrossCAD/Ware library Version 2021.2 and recommends software vendors upgrade to this version or later. Versions 2021.1 or earlier are still affected by the vulnerabilities.
MitigationUg3dReadPsrcisa_csaf_ot
Datakit has released CrossCAD/Ware library Version 2021.2 and recommends software vendors upgrade to this version or later. Versions 2021.1 or earlier are still affected by the vulnerabilities.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 3.6

v3.05.5mediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondary · CISA US

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:U/RC:Csecondary · Siemens ProductCERT DE

v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-611USCWE-611USCWE-611US

betroffene Produkte (19)

Betroffene Produkte und Versionsbereiche.

CatiaV5_3dRead: Versions 2021.1 and earlieralle Versionencisa_csaf_otUS
CatiaV6_3dRead: Versions 2021.1 and earlieralle Versionencisa_csaf_otUS
Jt3dReadPsr: Versions 2021.1 and earlieralle Versionencisa_csaf_otUS
KeyShot: Versions v10.1 and prioralle Versionencisa_csaf_otUS
Step3dRead: Versions 2021.1 and earlieralle Versionencisa_csaf_otUS
Ug3dReadPsr: Versions 2021.1 and earlieralle Versionencisa_csaf_otUS
Datakit CatiaV5_3dRead≤ 2021.1cisa_csaf_otUS
Datakit CatiaV6_3dRead≤ 2021.1cisa_csaf_otUS
Datakit Jt3dReadPsr≤ 2021.1cisa_csaf_otUS
Datakit KeyShot≤ 10.1cisa_csaf_otUS
Datakit Step3dRead≤ 2021.1cisa_csaf_otUS
Datakit Ug3dReadPsr≤ 2021.1cisa_csaf_otUS
n/a Datakit Software libraries embedded in Luxion KeyShot software≤ CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and priorenisa_euvdEU
datakit crosscadware≤ 2021.1nvdUScpe:2.3:a:datakit:crosscadware:*:*:*:*:*:*:*:*
luxion keyshot≤ 10.1nvdUScpe:2.3:a:luxion:keyshot:*:*:*:*:*:*:*:*
siemens solid edge se2020 firmwarealle VersionennvdUScpe:2.3:o:siemens:solid_edge_se2020_firmware:*:*:*:*:*:*:*:*
siemens solid edge se2021 firmwarealle VersionennvdUScpe:2.3:o:siemens:solid_edge_se2021_firmware:*:*:*:*:*:*:*:*
Siemens Solid Edge SE2020≤ vers:all/*siemens_psirtDE
Siemens Solid Edge SE2021≤ vers:all/*siemens_psirtDE

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-119468SSA-119468: Luxion KeyShot Vulnerabilities in Solid Edge2021-05-25csaf · siemens_psirtDE
The Solid Edge installation package includes a specific version of the third-party product KeyShot from Luxion, which may not contain the latest security fixes provided by Luxion. Siemens recommends to update KeyShot according to the information in the Luxion Security Advisory LSA-394129.
ICSA-21-145-01Datakit Libraries bundled in Luxion KeyShot2021-05-25icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could lead to execution of arbitrary code and disclosure of arbitrary files to unauthorized actors.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

veröffentlicht 2021-05-27geändert 2026-06-17

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan