TI-2021-15242 Aliases CVE-2021-37180 GHSA-j2fm-87x9-h5c6

A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7).

LOW 37CWE-824Published 2021-08-10 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-824 and the CVSS impact.

Summary

A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks proper validation while parsing user-supplied OBJ files that could cause an out of bounds access to an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13775)

Why it matters now

EPSS 0.01383 72nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	Solid Edge SE2021	All Versions < SE2021MP7	—	No fix listed	CNA

Solid Edge SE2021 VendorSiemens Affected All Versions < SE2021MP7 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:siemens:solid_edge_se2021_firmware::::::::	before se2021mp7	Vulnerable	Siemens
cpe:2.3:h:siemens:solid_edge_se2021:-:::::::*	not specified by NVD	Running on	Siemens

cpe:2.3:o:siemens:solid_edge_se2021_firmware:*:*:*:*:*:*:*:* Versions before se2021mp7 Vulnerable ·Siemens
cpe:2.3:h:siemens:solid_edge_se2021:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-37180
2026-10-03 Alias added: GHSA-j2fm-87x9-h5c6

References

Patch 1

https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf

Advisory 1

https://www.zerodayinitiative.com/advisories/ZDI-21-1113/

TI-2021-11487 Out-of-bounds write in Siemens Solid Edge CVSS 3.1HIGH 8.8
TI-2021-11486 Out-of-bounds write in Siemens Solid Edge CVSS 3.1HIGH 8.8
TI-2021-05544 Path traversal in Luxion KeyShot versions CVSS 3.1HIGH 7.8
TI-2021-05540 Out-of-bounds write in Luxion KeyShot CVSS 3.1HIGH 7.8
TI-2021-08981 Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr… CVSS 3.1HIGH 7.8
TI-2021-08979 Stack-based buffer overflow in Datakit Software libraries embedded in Luxion KeyShot… CVSS 3.1HIGH 7.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences