CVE-2021-37179
📋 TL;DR
This vulnerability in Solid Edge SE2021 allows attackers to execute arbitrary code by tricking users into opening malicious OBJ files. The use-after-free condition in PSKERNEL.dll can lead to remote code execution. All users of Solid Edge SE2021 versions before SE2021MP7 are affected.
💻 Affected Systems
- Solid Edge SE2021
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, allowing attacker to install malware, steal data, or pivot to other systems.
Likely Case
Targeted attacks against engineering/manufacturing organizations where attackers send malicious OBJ files via email or compromised websites.
If Mitigated
Limited impact if file execution is restricted, users are trained not to open untrusted files, and proper endpoint protection is in place.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. The vulnerability is a use-after-free condition which typically requires some exploit development skill to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SE2021MP7
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf
Restart Required: Yes
Instructions:
1. Download Solid Edge SE2021 Maintenance Pack 7 (SE2021MP7) from Siemens support portal. 2. Close all Solid Edge applications. 3. Run the installer with administrative privileges. 4. Restart the system after installation completes.
🔧 Temporary Workarounds
Block OBJ file execution
windowsConfigure application control or endpoint protection to block execution of OBJ files in Solid Edge.
User training and file restrictions
allTrain users not to open OBJ files from untrusted sources and implement email filtering for OBJ attachments.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of Solid Edge from untrusted locations
- Use endpoint detection and response (EDR) solutions to monitor for suspicious file parsing activities
🔍 How to Verify
Check if Vulnerable:
Check Solid Edge version in Help > About Solid Edge. If version is earlier than SE2021MP7, the system is vulnerable.Check Version:
In Solid Edge: Help > About Solid EdgeVerify Fix Applied:
Verify version shows SE2021MP7 or later in Help > About Solid Edge.📡 Detection & Monitoring
Log Indicators:
- Solid Edge crash logs showing PSKERNEL.dll errors
- Windows Application logs showing Solid Edge crashes when opening OBJ files
Network Indicators:
- Unusual outbound connections from Solid Edge process after opening OBJ files
SIEM Query:
process_name:"sedge.exe" AND (event_id:1000 OR event_id:1001) AND module_name:"PSKERNEL.dll"