Summary
Siemens NX is affected by two vulnerabilities that could be triggered when the application reads OBJ files. If a user is tricked to open a malicious file with the affected application, this could lead to an access violation, and potentially also to arbitrary code execution on the target host system.
Siemens has released updates for the NX and recommends to update to the latest version. Siemens recommends to avoid opening of untrusted files from unknown sources.
Vulnerabilities 2
-
Unscored —
A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988…
-
Unscored —
A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988…
Revision history
-
#2
Revision - Fixing typos
-
#1
Publication Date
References
-
SSA-328042: File Parsing Vulnerabilities in OBJ Translator in NX - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-328042.txt
-
SSA-328042: File Parsing Vulnerabilities in OBJ Translator in NX - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-328042.pdf
-
ICS Advisory ICSA-21-315-08 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-315-08
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B