CVE-2021-25173 – This vulnerability in Open Design Alliance Draw... (How to Fix)

Q: What is the severity of CVE-2021-25173?

CVE-2021-25173 has a CVSS score of 7.8 (HIGH). This vulnerability in Open Design Alliance Drawings SDK allows attackers to crash applications by sending specially crafted DGN files that trigger excessive memory allocation. It affects any software using vulnerable versions of the SDK to process DGN files, potentially causing denial of service.

📋 TL;DR

This vulnerability in Open Design Alliance Drawings SDK allows attackers to crash applications by sending specially crafted DGN files that trigger excessive memory allocation. It affects any software using vulnerable versions of the SDK to process DGN files, potentially causing denial of service.

💻 Affected Systems

Products:

Open Design Alliance Drawings SDK
Software using ODA Drawings SDK (e.g., Siemens products mentioned in advisories)

Versions: All versions before 2021.12

Operating Systems: All platforms where ODA Drawings SDK is used

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using the vulnerable SDK to parse DGN files is affected regardless of configuration.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete application crash leading to denial of service, potentially disrupting business operations if critical systems are affected.

🟠

Likely Case

Application crashes when processing malicious DGN files, causing temporary unavailability and potential data loss in unsaved work.

🟢

If Mitigated

Limited impact with proper input validation and memory protection mechanisms in place.

🌐 Internet-Facing: MEDIUM - Applications accepting DGN file uploads from untrusted sources are vulnerable.

🏢 Internal Only: LOW - Risk is limited to internal users processing malicious files.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only a malicious DGN file, making it simple to trigger.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2021.12 or later

Vendor Advisory: https://www.opendesign.com/security-advisories

Restart Required: Yes

Instructions:

1. Identify applications using ODA Drawings SDK
2. Update to SDK version 2021.12 or later
3. Rebuild/redeploy applications with updated SDK
4. Restart affected services

🔧 Temporary Workarounds

Input Validation

all

Implement strict validation of DGN files before processing

Memory Limit Enforcement

all

Configure memory limits for applications processing DGN files

🧯 If You Can't Patch

Implement network segmentation to isolate vulnerable systems
Use application allowlisting to restrict which applications can process DGN files

🔍 How to Verify

Check if Vulnerable:

Check application dependencies for ODA Drawings SDK version < 2021.12

Check Version:

Check application documentation or contact vendor for SDK version information

Verify Fix Applied:

Verify SDK version is 2021.12 or later and test with sample DGN files

📡 Detection & Monitoring

Log Indicators:

Application crashes when processing DGN files
Memory allocation errors in application logs
Abnormal termination of CAD-related processes

Network Indicators:

Unexpected DGN file transfers to vulnerable systems

SIEM Query:

search 'application crash' AND 'DGN' OR 'ODA' in application logs

📊 Metadata

CVE ID: CVE-2021-25173

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-770

Published: January 18, 2021

Last Updated: November 21, 2024

🔗 References

https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf Patch,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf Patch,Third Party Advisory
https://www.opendesign.com/security-advisories Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-225/ Third Party Advisory,VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf Patch,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf Patch,Third Party Advisory
https://www.opendesign.com/security-advisories Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-225/ Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-25173, you might also want to check these: