CVE-2021-25678

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions < SE2020MP14), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12529)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Siemens	Solid Edge SE2020	All versions < SE2020MP13
Siemens	Solid Edge SE2020	All versions < SE2020MP14
Siemens	Solid Edge SE2021	All Versions < SE2021MP4

References

https://cert-portal.siemens.com/productcert/pdf/ssa-574442.pdfVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-611/Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-574442.pdfVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-611/Third Party Advisory, VDB Entry

Timeline

Published: Apr 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-256795.4The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact a CVE-2021-256806.1The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at min CVE-2021-256817.5AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for CVE-2021-256827.8It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.CVE-2021-256837.8It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.CVE-2021-256847.8It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.CVE-2021-256885.5Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21 CVE-2021-256899.8An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remotely execute code.CVE-2021-256907.5A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the software.CVE-2021-256924.6Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.CVE-2021-256937.5An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer dereference.CVE-2021-256947.8Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels