CVE-2021-22645

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll from a remote network share. As a result, the .dll entry point can be executed without sufficient UI warning.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-357

Affected software

Vendor	Product	Versions
n/a	Luxion KeyShot	versions prior to 10.1
n/a	Luxion KeyShot Viewer	versions prior to 10.1
n/a	Luxion KeyShot Network Rendering	versions prior to 10.1
n/a	Luxion KeyVR	versions prior to 10.1

References

https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdfThird Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-323/Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-231216.pdfThird Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-035-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-323/Third Party Advisory, VDB Entry

Timeline

Published: Feb 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-226469.8The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicio CVE-2021-226477.8Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1 CVE-2021-226489.8Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.CVE-2021-226497.8Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1 CVE-2021-226509.8An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could le CVE-2021-226517.8When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot N CVE-2021-226529.8Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attac CVE-2021-226537.8Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a CVE-2021-226547.5Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose infor CVE-2021-226557.8Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a CVE-2021-226567.5Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.CVE-2021-226579.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitr