CVE-2020-28382
📋 TL;DR
This vulnerability in Solid Edge allows attackers to execute arbitrary code by exploiting improper validation of PAR files. Users of Solid Edge SE2020 before MP12 and SE2021 before MP2 are affected when opening malicious PAR files.
💻 Affected Systems
- Solid Edge SE2020
- Solid Edge SE2021
📦 What is this software?
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution with the privileges of the Solid Edge process, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local user or attacker with file access executes malicious code through crafted PAR files, compromising the workstation and potentially spreading through shared files.
If Mitigated
Limited impact with proper network segmentation, application whitelisting, and user training preventing execution of malicious files.
🎯 Exploit Status
Exploitation requires user interaction to open malicious PAR file. Multiple ZDI advisories suggest active research interest.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Solid Edge SE2020MP12 or later, Solid Edge SE2021MP2 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
Restart Required: Yes
Instructions:
1. Download latest Solid Edge maintenance pack from Siemens support portal. 2. Close all Solid Edge applications. 3. Run installer with administrative privileges. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Block PAR file execution
windowsUse application control or group policy to block execution of PAR files or restrict Solid Edge from opening untrusted files.
User training and file validation
allTrain users to only open PAR files from trusted sources and implement file validation procedures.
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized Solid Edge execution
- Restrict user permissions and implement least privilege access controls
🔍 How to Verify
Check if Vulnerable:
Check Solid Edge version in Help > About. If version is SE2020 before MP12 or SE2021 before MP2, system is vulnerable.Check Version:
Open Solid Edge, navigate to Help > About Solid EdgeVerify Fix Applied:
Verify version shows SE2020MP12 or later, or SE2021MP2 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Solid Edge crash logs with memory access violations
- Unexpected PAR file processing from untrusted sources
Network Indicators:
- Unusual outbound connections from Solid Edge process
- File transfers of PAR files from external sources
SIEM Query:
Process: 'sedge.exe' AND (EventID: 1000 OR EventID: 1001) AND Description: 'access violation'🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04
- https://www.zerodayinitiative.com/advisories/ZDI-21-052/
- https://www.zerodayinitiative.com/advisories/ZDI-21-075/
- https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04
- https://www.zerodayinitiative.com/advisories/ZDI-21-052/
- https://www.zerodayinitiative.com/advisories/ZDI-21-075/
