CVE-2023-22295
mediumPriorität · verfolgen · 22EPSS 0.002 · 11. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
Datakit CrossCadWare_x64.dll contains an out of bounds read past the end of an allocated buffer while parsing a specially crafted SLDPRT file. This vulnerability could allow an attacker to disclose sensitive information.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSolid Edge SE2022siemens_psirt
Update to V222.0MP12 or later version
https://support.sw.siemens.com/ - BehobenSolid Edge SE2023siemens_psirt
Update to V223.0Update2 or later version
https://support.sw.siemens.com/ - BehobenSolid Edge SE2022cisa_csaf_ot
Update to V222.0MP12 or later version
https://support.sw.siemens.com/ - BehobenSolid Edge SE2023cisa_csaf_ot
Update to V223.0Update2 or later version
https://support.sw.siemens.com/ - BehobenCrossCAD/Ware_x64 librarycisa_csaf_ot
Datakit has identified specific workarounds and mitigations that should be applied to reduce the risk:
- MitigationSolid Edge SE2022siemens_psirt
Do not open untrusted X_B, DWG, DXF, STL, STP, SLDPRT and PAR files in Solid Edge
- MitigationSolid Edge SE2023siemens_psirt
Do not open untrusted X_B, DWG, DXF, STL, STP, SLDPRT and PAR files in Solid Edge
- MitigationSolid Edge SE2022cisa_csaf_ot
Do not open untrusted X_B, DWG, DXF, STL, STP, SLDPRT and PAR files in Solid Edge
- MitigationSolid Edge SE2023cisa_csaf_ot
Do not open untrusted X_B, DWG, DXF, STL, STP, SLDPRT and PAR files in Solid Edge
- Kein Fix geplantSolid Edge SE2022siemens_psirt
Currently no fix is planned
- Kein Fix geplantSolid Edge SE2022cisa_csaf_ot
Currently no fix is planned
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.3–5.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (12)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-491245SSA-491245: Multiple File Parsing Vulnerabilities in Solid Edge2023-02-14csaf · siemens_psirtDE
Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as X_B, DWG, DXF, STL, STP, SLDPRT and PAR format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to crash the application, extract data or potentially lead to arbitrary code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.
- ICSA-23-047-01Siemens Solid Edge2023-02-14icsa · cisa_csaf_otUS
Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as X_B, DWG, DXF, STL, STP, SLDPRT and PAR format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to crash the application, extract data or potentially lead to arbitrary code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.
- ICSA-23-103-14Datakit CrossCAD-WARE2023-04-20icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information or execute arbitrary code.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2023-22295/cnnvd
- https://solidedge.siemens.com/zh-hans/Patchcnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.0960cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.2154cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14enisa_euvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-14MitigationThird Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan