Read the docs
TI-2021-15265 Aliases CVE-2021-37203GHSA-98jw-m4q8-f849

Out-of-bounds read in Siemens NX 1980 Series

Priority LOW 32CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8). The plmxmlAdapterIFC.dll contains an out-of-bounds read while parsing user supplied IFC files which could result in a read past the end of an allocated buffer. This could allow an attacker to cause a denial-of-service condition or read sensitive information from memory locations.

Why it matters now

EPSS 0.00637 50th percentileScored 2026-11-07
Fix Fixed NX 1980 Series (Siemens): V1984

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensNX 1980 Seriesbefore V1984V1984Patch availableCNA
SiemensSolid Edge SE2021All versions < SE2021MP8—No fix listedCNA
  • NX 1980 Series VendorSiemens Affected before V1984 Fixed in V1984 Patch available CNA
  • Solid Edge SE2021 VendorSiemens Affected All versions < SE2021MP8 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:siemens:nx_1980:*:*:*:*:*:*:*:*before 1984VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*before se2021VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*se2021VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*se2021 maintenance_pack1VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*se2021 maintenance_pack2VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*se2021 maintenance_pack3VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*se2021 maintenance_pack4VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack5:*:*:*:*:*:*se2021 maintenance_pack5VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack6:*:*:*:*:*:*se2021 maintenance_pack6VulnerableSiemens
cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack7:*:*:*:*:*:*se2021 maintenance_pack7VulnerableSiemens
  • cpe:2.3:a:siemens:nx_1980:*:*:*:*:*:*:*:* Versions before 1984 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:* Versions before se2021 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:* Versions se2021 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:* Versions se2021 maintenance_pack1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:* Versions se2021 maintenance_pack2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:* Versions se2021 maintenance_pack3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:* Versions se2021 maintenance_pack4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack5:*:*:*:*:*:* Versions se2021 maintenance_pack5 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack6:*:*:*:*:*:* Versions se2021 maintenance_pack6 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack7:*:*:*:*:*:* Versions se2021 maintenance_pack7 Vulnerable ·Siemens

Remediation

  • Fix · CNA NX 1980 Series (Siemens) Fixed in V1984

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37203
  2. 2026-10-03 Alias added: GHSA-98jw-m4q8-f849
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 2

  • TI-2021-15264 Use after free in Siemens NX 1980 Series CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences