← Back

CVE-2021-22651

nvd nist
Published: Feb 23, 2021Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are, while processing the extraction of temporary files, suffering from a directory traversal vulnerability, which allows an attacker to store arbitrary scripts into automatic startup folders.

Affected (6)

Luxion
4 products
Keyshot
Keyshot Network Rendering
Keyshot Viewer
Keyvr
Siemens
2 products
Solid Edge Se2020 Firmware
Solid Edge Se2021 Firmware
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Keyshot
Before 10.1
Keyshot Network Rendering
Before 10.1
Keyshot Viewer
Before 10.1
Keyvr
Before 10.1
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Solid Edge Se2020 Firmware
All versions
Running on/withPlatform Versions
Siemens
Solid Edge Se2020
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Solid Edge Se2021 Firmware
All versions
Running on/withPlatform Versions
Siemens
Solid Edge Se2021
All versions

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (6)

Source: ics-cert@hq.dhs.gov
Third Party Advisory
Source: ics-cert@hq.dhs.gov
PatchThird Party AdvisoryUS Government Resource
Source: ics-cert@hq.dhs.gov
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry

Timeline

No history available yet.