CVE-2021-25177 – A type confusion vulnerability in Open Design A... (How to Fix)

Q: What is the severity of CVE-2021-25177?

CVE-2021-25177 has a CVSS score of 7.8 (HIGH). A type confusion vulnerability in Open Design Alliance Drawings SDK allows attackers to crash applications by providing malformed .DXF or .DWG files. This can lead to denial of service attacks. Affected are any applications using vulnerable versions of the SDK to process CAD files.

📋 TL;DR

A type confusion vulnerability in Open Design Alliance Drawings SDK allows attackers to crash applications by providing malformed .DXF or .DWG files. This can lead to denial of service attacks. Affected are any applications using vulnerable versions of the SDK to process CAD files.

💻 Affected Systems

Products:

Open Design Alliance Drawings SDK
Applications using ODA Drawings SDK for CAD file processing

Versions: All versions before 2021.11

Operating Systems: All platforms where ODA SDK is used

Default Config Vulnerable: ⚠️ Yes

Notes: Any application using the vulnerable SDK to parse .DXF or .DWG files is affected regardless of OS.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete application crash leading to denial of service, potentially disrupting business operations that rely on CAD file processing.

🟠

Likely Case

Application crashes when processing malicious CAD files, causing temporary service disruption.

🟢

If Mitigated

No impact if patched or if file processing is restricted to trusted sources.

🌐 Internet-Facing: MEDIUM - Applications accepting CAD file uploads from untrusted sources are vulnerable to DoS attacks.

🏢 Internal Only: LOW - Internal CAD processing tools are less likely to receive malicious files unless compromised internally.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only a malicious CAD file, making it simple to trigger crashes.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2021.11 or later

Vendor Advisory: https://www.opendesign.com/security-advisories

Restart Required: Yes

Instructions:

1. Identify applications using ODA Drawings SDK. 2. Update SDK to version 2021.11 or later. 3. Rebuild/redeploy applications with updated SDK. 4. Restart affected services.

🔧 Temporary Workarounds

Restrict CAD file sources

all

Only allow CAD files from trusted sources to be processed.

Implement file validation

all

Add validation checks for CAD files before processing.

🧯 If You Can't Patch

Isolate CAD processing to dedicated systems with limited network access.
Monitor for application crashes and investigate any CAD file processing failures.

🔍 How to Verify

Check if Vulnerable:

Check application documentation or contact vendor to confirm ODA SDK version used. Versions before 2021.11 are vulnerable.

Check Version:

Application-specific; consult vendor documentation for version checking.

Verify Fix Applied:

Verify SDK version is 2021.11 or later and test with known safe CAD files to ensure stability.

📡 Detection & Monitoring

Log Indicators:

Application crashes during CAD file processing
Error logs mentioning ODA SDK or CAD parsing failures

Network Indicators:

Unusual CAD file uploads followed by service disruptions

SIEM Query:

search 'application crash' AND ('DXF' OR 'DWG' OR 'ODA')

📊 Metadata

CVE ID: CVE-2021-25177

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-843

Published: January 18, 2021

Last Updated: November 21, 2024

🔗 References

https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf Patch,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf Patch,Third Party Advisory
https://www.opendesign.com/security-advisories Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-219/ Third Party Advisory,VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf Patch,Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf Patch,Third Party Advisory
https://www.opendesign.com/security-advisories Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-219/ Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-25177, you might also want to check these: