CVE-2024-31980
📋 TL;DR
This vulnerability in Siemens Parasolid allows remote code execution when processing malicious X_T part files. An out-of-bounds write vulnerability enables attackers to execute arbitrary code within the application's context. Organizations using affected Parasolid versions for CAD/CAM operations are at risk.
💻 Affected Systems
- Siemens Parasolid
📦 What is this software?
Parasolid by Siemens
Parasolid by Siemens
Parasolid by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Application crash leading to denial of service or limited code execution within the Parasolid process context.
If Mitigated
Application crash with no code execution if memory protections (ASLR, DEP) are effective.
🎯 Exploit Status
Exploitation requires crafting a malicious X_T file, but no authentication is needed to trigger the vulnerability when the file is processed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V35.1.256, V36.0.210, V36.1.185 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-489698.html
Restart Required: Yes
Instructions:
1. Identify Parasolid version in use. 2. Download appropriate patch from Siemens support portal. 3. Apply patch following vendor instructions. 4. Restart affected applications/services.
🔧 Temporary Workarounds
Restrict X_T file processing
allBlock or sandbox processing of X_T files from untrusted sources
Application sandboxing
allRun Parasolid-based applications with reduced privileges or in containers
🧯 If You Can't Patch
- Implement strict file validation for X_T files before processing
- Use application allowlisting to prevent unauthorized Parasolid execution
🔍 How to Verify
Check if Vulnerable:
Check Parasolid version in application about dialog or via vendor documentationCheck Version:
Application-specific (typically in Help > About or via vendor tools)Verify Fix Applied:
Verify installed version is equal to or greater than patched versions listed in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing X_T files
- Unexpected memory access errors in application logs
Network Indicators:
- Unusual outbound connections from CAD applications
- File transfers of X_T files to untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 with Parasolid process name AND .x_t file extension