CVE-2021-22647

Опубликовано: 23 фев. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to multiple out-of-bounds write issues while processing project files, which may allow an attacker to execute arbitrary code.

Ссылки

https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdf
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01
Third Party Advisory
US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-318/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-320/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-321/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-322/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-326/
Third Party Advisory
VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdf
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01
Third Party Advisory
US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-318/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-320/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-321/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-322/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-326/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:luxion:keyshot:*:*:*:*:*:*:*:*

Версия до 10.1 (исключая)

cpe:2.3:a:luxion:keyshot_network_rendering:*:*:*:*:*:*:*:*

Версия до 10.1 (исключая)

cpe:2.3:a:luxion:keyshot_viewer:*:*:*:*:*:*:*:*

Версия до 10.1 (исключая)

cpe:2.3:a:luxion:keyvr:*:*:*:*:*:*:*:*

Версия до 10.1 (исключая)

Конфигурация 2

Одновременно

cpe:2.3:o:siemens:solid_edge_se2020_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:solid_edge_se2020:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:siemens:solid_edge_se2021_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:solid_edge_se2021:-:*:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.00368

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

GHSA-j28w-7p4q-hrq8

github

больше 3 лет назад

BDU:2021-01072

CVSS3: 7.8

fstec

около 5 лет назад

Уязвимость программных средств рендеринга 3D-моделей Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering и Luxion KeyVR, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 58%

0.00368

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787