CVE-2021-25175 – A type conversion vulnerability in Open Design ... (How to Fix)

Q: What is the severity of CVE-2021-25175?

CVE-2021-25175 has a CVSS score of 7.8 (HIGH). A type conversion vulnerability in Open Design Alliance Drawings SDK allows attackers to crash applications by providing malformed .DXF or .DWG files. This enables denial of service attacks against systems using vulnerable versions of the SDK. Affected are applications that process CAD files using ODA Drawings SDK before version 2021.11.

📋 TL;DR

A type conversion vulnerability in Open Design Alliance Drawings SDK allows attackers to crash applications by providing malformed .DXF or .DWG files. This enables denial of service attacks against systems using vulnerable versions of the SDK. Affected are applications that process CAD files using ODA Drawings SDK before version 2021.11.

💻 Affected Systems

Products:

Open Design Alliance Drawings SDK
Applications using ODA Drawings SDK

Versions: All versions before 2021.11

Operating Systems: Windows, Linux, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using the vulnerable SDK to process .DXF or .DWG files is affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete application crash leading to denial of service, potentially disrupting CAD workflows or automated systems processing CAD files.

🟠

Likely Case

Application crash when processing malicious CAD files, causing temporary service disruption.

🟢

If Mitigated

No impact if patched version is used or if file processing is restricted to trusted sources.

🌐 Internet-Facing: MEDIUM - Applications accepting CAD file uploads from untrusted sources could be targeted for DoS.

🏢 Internal Only: LOW - Internal CAD processing systems with trusted file sources face minimal risk.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires providing a malformed CAD file to a vulnerable application.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2021.11 or later

Vendor Advisory: https://www.opendesign.com/security-advisories

Restart Required: Yes

Instructions:

1. Identify applications using ODA Drawings SDK. 2. Update SDK to version 2021.11 or later. 3. Rebuild/redeploy applications with updated SDK. 4. Restart affected services.

🔧 Temporary Workarounds

File type restriction

all

Block or restrict processing of .DXF and .DWG files from untrusted sources

Input validation

all

Implement file validation/sanitization before passing to ODA SDK

🧯 If You Can't Patch

Implement strict file upload controls and validation for CAD files
Isolate CAD processing systems and monitor for crashes

🔍 How to Verify

Check if Vulnerable:

Check application documentation or contact vendor to confirm ODA SDK version used. Version < 2021.11 indicates vulnerability.

Check Version:

Application-specific; typically requires checking build configuration or vendor documentation.

Verify Fix Applied:

Confirm ODA SDK version is 2021.11 or later and test with known safe CAD files.

📡 Detection & Monitoring

Log Indicators:

Application crashes when processing CAD files
Unexpected termination of CAD-related processes

Network Indicators:

Multiple CAD file uploads followed by service disruption

SIEM Query:

EventID: Application Crash AND ProcessName contains 'CAD' OR 'ODA'

📊 Metadata

CVE ID: CVE-2021-25175

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-704

Published: January 18, 2021

Last Updated: November 21, 2024

🔗 References

https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf Patch,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf Patch,Third Party Advisory
https://www.opendesign.com/security-advisories Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-218/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-223/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-224/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-244/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-245/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-246/ Third Party Advisory,VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf Patch,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf Patch,Third Party Advisory
https://www.opendesign.com/security-advisories Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-218/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-223/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-224/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-244/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-245/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-246/ Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-25175, you might also want to check these: