CVE-2021-41535
📋 TL;DR
This CVE describes a use-after-free vulnerability in Siemens NX and Solid Edge software when parsing OBJ files. An attacker could exploit this to execute arbitrary code with the privileges of the current user. Affected users include those running vulnerable versions of Siemens NX 1953 Series, NX 1980 Series, or Solid Edge SE2021.
💻 Affected Systems
- Siemens NX 1953 Series
- Siemens NX 1980 Series
- Solid Edge SE2021
📦 What is this software?
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Local privilege escalation or arbitrary code execution when a user opens a malicious OBJ file.
If Mitigated
Limited impact if software runs with minimal privileges and network access is restricted.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious OBJ file. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NX 1953 Series: V1973.3700 or later; NX 1980 Series: V1988 or later; Solid Edge SE2021: SE2021MP8 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf
Restart Required: Yes
Instructions:
1. Download the latest patch from Siemens support portal. 2. Install the update following vendor instructions. 3. Restart the application and system as required.
🔧 Temporary Workarounds
Restrict OBJ file handling
allBlock or restrict opening of OBJ files from untrusted sources.
Run with reduced privileges
windowsConfigure applications to run with minimal user privileges.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code.
- Use network segmentation to isolate affected systems from critical assets.
🔍 How to Verify
Check if Vulnerable:
Check the software version in Help > About or via command line: nx --version or sedge --versionCheck Version:
On Windows: Open application and check Help > About. On Linux: Use 'nx --version' or 'sedge --version'Verify Fix Applied:
Verify installed version matches or exceeds patched versions listed in vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening OBJ files
- Unusual process creation from CAD applications
Network Indicators:
- Unexpected outbound connections from CAD software
SIEM Query:
Process creation where parent process contains 'nx.exe' or 'sedge.exe' and command line contains '.obj'🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-21-1119/
- https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-728618.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-21-1119/
