CVE-2023-41033

highpriority · track · 0EPSS 0.002 · 13 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.22% (13th) EPSS

CVSS 7.8 · high

Is it mine?

24 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.260), Parasolid V35.1 (All versions < V35.1.246), Parasolid V36.0 (All versions < V36.0.156), Simcenter Femap V2301 (All versions < V2301.0003), Simcenter Femap V2306 (All versions < V2306.0001). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21266)

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedParasolid V35.0siemens_psirt
Update to V35.0.260 or later version
https://support.sw.siemens.com/en-US/product/258316782/
FixedParasolid V35.1siemens_psirt
Update to V35.1.246 or later version
https://support.sw.siemens.com/en-US/product/258316782/
FixedParasolid V36.0siemens_psirt
Update to V36.0.156 or later version
https://support.sw.siemens.com/en-US/product/258316782/
FixedSimcenter Femap V2301siemens_psirt
Update to V2301.0003 or later version
https://support.sw.siemens.com/
FixedSimcenter Femap V2306siemens_psirt
Update to V2306.0001 or later version
https://support.sw.siemens.com/
FixedParasolid V35.0cisa_csaf_ot
Update to V35.0.260 or later version
https://support.sw.siemens.com/en-US/product/258316782/
FixedParasolid V35.1cisa_csaf_ot
Update to V35.1.246 or later version
https://support.sw.siemens.com/en-US/product/258316782/
FixedParasolid V36.0cisa_csaf_ot
Update to V36.0.156 or later version
https://support.sw.siemens.com/en-US/product/258316782/
MitigationParasolid V35.0siemens_psirt
Do not open untrusted X_T files in Parasolid
MitigationParasolid V35.1siemens_psirt
Do not open untrusted X_T files in Parasolid
MitigationParasolid V36.0siemens_psirt
Do not open untrusted X_T files in Parasolid
MitigationSimcenter Femap V2301siemens_psirt
Do not open untrusted X_T files in Simcenter Femap
MitigationSimcenter Femap V2306siemens_psirt
Do not open untrusted X_T files in Simcenter Femap
MitigationParasolid V35.0cisa_csaf_ot
Do not open untrusted X_T files in Parasolid
MitigationParasolid V35.1cisa_csaf_ot
Do not open untrusted X_T files in Parasolid
MitigationParasolid V36.0cisa_csaf_ot
Do not open untrusted X_T files in Parasolid

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.17.8highAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · productcert@siemens.com DEexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USCWE-787USCWE-787USCWE-787US

affected products (24)

Products and version ranges known to be affected.

Parasolid V35.0all versionscisa_csaf_otUS
Parasolid V35.1all versionscisa_csaf_otUS
Parasolid V36.0all versionscisa_csaf_otUS
Siemens Parasolid V35.0< V35.0.260cisa_csaf_otUS
Siemens Parasolid V35.1< V35.1.246cisa_csaf_otUS
Siemens Parasolid V36.0< V36.0.156cisa_csaf_otUS
Siemens Parasolid V35.0All versions → V35.0.260enisa_euvdEU
Siemens Parasolid V35.1All versions → V35.1.246enisa_euvdEU
Siemens Parasolid V36.0All versions → V36.0.156enisa_euvdEU
Siemens Simcenter Femap V2301All versions → V2301.0003enisa_euvdEU
Siemens Simcenter Femap V2306All versions → V2306.0001enisa_euvdEU
Siemens AG Parasolid35.0 → 35.0.260fstec_bduRU
Siemens AG Parasolid35.1 → 35.1.246fstec_bduRU
Siemens AG Parasolid36.0 → 36.0.156fstec_bduRU
siemens parasolid35.0 → 35.0.260nvdUScpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*
siemens parasolid35.1 → 35.1.246nvdUScpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*
siemens parasolid36.0 → 36.0.156nvdUScpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*
siemens simcenter femap2301.0 → 2301.0003nvdUScpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*
siemens simcenter femap2306.0 → 2306.0001nvdUScpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*
Siemens Parasolid V35.0≤ vers:all/<V35.0.260siemens_psirtDE

showing 20 of 24

advisories (3)

Vendor and ecosystem advisories describing this.

SSA-190839SSA-190839: X_T File Parsing Vulnerabilities in Parasolid2023-09-12csaf · siemens_psirtDE
Parasolid is affected by out of bounds write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released updates for the affected products and recommends to update to the latest versions.
SSA-887122SSA-887122: X_T File Parsing Vulnerabilities in Simcenter Femap2023-11-14csaf · siemens_psirtDE
Simcenter Femap is affected by out of bounds write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released updates for the affected products and recommends to update to the latest versions.
ICSA-23-257-02Siemens Parasolid2023-09-12icsa · cisa_csaf_otUS
Parasolid is affected by out of bounds write vulnerabilities that could be triggered when the application reads files in X_T format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of the current process. Siemens has released updates for the affected products and recommends to update to the latest versions.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

published 2023-09-12modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan