CVE-2024-47940
📋 TL;DR
This vulnerability in Solid Edge SE2024 allows attackers to execute arbitrary code by exploiting an out-of-bounds read when parsing malicious PSM files. Users of Solid Edge SE2024 versions before V224.0 Update 9 are affected. The attack occurs within the current process context, potentially compromising the system.
💻 Affected Systems
- Solid Edge SE2024
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or application crash when users open specially crafted PSM files from untrusted sources.
If Mitigated
Limited impact with proper file validation and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user to open a malicious PSM file; no known public exploits as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V224.0 Update 9 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-351178.html
Restart Required: Yes
Instructions:
1. Download Solid Edge SE2024 V224.0 Update 9 from Siemens support portal
2. Close all Solid Edge applications
3. Run the update installer with administrative privileges
4. Restart the system after installation completes
🔧 Temporary Workarounds
Restrict PSM file handling
windowsBlock or restrict opening of PSM files from untrusted sources
Application control policies
windowsImplement application whitelisting to prevent unauthorized Solid Edge execution
🧯 If You Can't Patch
- Implement strict file validation policies to block PSM files from untrusted sources
- Use network segmentation to isolate Solid Edge workstations from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Solid Edge version in Help > About; versions below V224.0 Update 9 are vulnerableCheck Version:
Not applicable - check via Solid Edge GUI Help > About menuVerify Fix Applied:
Verify version shows V224.0 Update 9 or higher in Help > About📡 Detection & Monitoring
Log Indicators:
- Solid Edge crash logs with memory access violations
- Unexpected PSM file processing from unusual locations
Network Indicators:
- Unusual outbound connections from Solid Edge process after PSM file handling
SIEM Query:
Process: 'sedge.exe' AND (FileExtension: '.psm' OR EventID: 1000)