CVE-2023-24581
📋 TL;DR
A use-after-free vulnerability in Solid Edge CAD software allows attackers to execute arbitrary code by tricking users into opening malicious STP files. This affects Solid Edge SE2022 and SE2023 users who haven't applied security updates. Successful exploitation gives attackers the same privileges as the current user process.
💻 Affected Systems
- Solid Edge SE2022
- Solid Edge SE2023
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Local privilege escalation or malware execution when users open malicious STP files from untrusted sources.
If Mitigated
Limited impact with proper file validation, user awareness, and restricted permissions preventing successful exploitation.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of file format manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Solid Edge SE2022: V222.0MP12 or later; Solid Edge SE2023: V223.0Update2 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
Restart Required: Yes
Instructions:
1. Download latest update from Siemens support portal. 2. Close all Solid Edge applications. 3. Run installer with administrative privileges. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Block STP file extensions
windowsPrevent Solid Edge from opening STP files via group policy or application restrictions
Use application whitelisting
windowsRestrict execution of Solid Edge to trusted directories only
🧯 If You Can't Patch
- Implement strict file validation policies to block untrusted STP files
- Train users to avoid opening CAD files from unknown sources and enable macro/script warnings
🔍 How to Verify
Check if Vulnerable:
Check Solid Edge version via Help > About Solid Edge and compare against patched versionsCheck Version:
Not applicable - check via GUI in Help > About Solid EdgeVerify Fix Applied:
Confirm version is SE2022 V222.0MP12+ or SE2023 V223.0Update2+ in About dialog📡 Detection & Monitoring
Log Indicators:
- Solid Edge crash logs with memory access violations
- Unexpected process creation from Solid Edge
Network Indicators:
- Unusual outbound connections from Solid Edge process
SIEM Query:
Process creation where parent_process contains 'sedge' AND (process_name contains 'cmd' OR process_name contains 'powershell')