CVE-2023-39549
📋 TL;DR
A use-after-free vulnerability in Solid Edge SE2023 allows attackers to execute arbitrary code by tricking users into opening malicious DWG files. This affects all versions before V223.0 Update 2. Users who open untrusted DWG files are at risk of complete system compromise.
💻 Affected Systems
- Solid Edge SE2023
📦 What is this software?
Solid Edge by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with the same privileges as the Solid Edge process, potentially leading to ransomware deployment, data theft, or lateral movement within the network.
Likely Case
Local privilege escalation leading to malware installation, data exfiltration, or persistence mechanisms being established on the compromised system.
If Mitigated
Limited impact if proper application sandboxing, least privilege principles, and file validation are implemented, potentially containing the exploit to the application context.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious file) and knowledge of the specific use-after-free condition in DWG parsing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V223.0 Update 2
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-932528.pdf
Restart Required: Yes
Instructions:
1. Open Solid Edge SE2023
2. Navigate to Help > Check for Updates
3. Install V223.0 Update 2
4. Restart the application
🔧 Temporary Workarounds
Restrict DWG file handling
windowsConfigure Windows to open DWG files with a different application or block them entirely
Use Group Policy or registry to modify file associations
Application sandboxing
windowsRun Solid Edge with reduced privileges using application control solutions
🧯 If You Can't Patch
- Implement strict file validation policies to block untrusted DWG files
- Use network segmentation to isolate systems running vulnerable versions
🔍 How to Verify
Check if Vulnerable:
Check Solid Edge version in Help > About. If version is below V223.0 Update 2, the system is vulnerable.Check Version:
Not applicable - check through application GUIVerify Fix Applied:
Verify version is V223.0 Update 2 or higher in Help > About.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening DWG files
- Unusual process creation from Solid Edge executable
Network Indicators:
- Outbound connections from Solid Edge process to unexpected destinations
SIEM Query:
Process creation where parent_process contains 'Solid Edge' AND (process_name contains 'cmd.exe' OR process_name contains 'powershell.exe')