CVE-2021-31343

Published: Jun 8, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocation structure. An attacker could leverage this vulnerability to execute code in the context of the current process.

Affected (2)

Products: Siemens: Solid Edge Se2020 Firmware, Solid Edge Se2021 Firmware

2 products

Solid Edge Se2020 Firmware

Solid Edge Se2021 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Solid Edge Se2020 Firmware	Before 2020mp14

Running on/with	Platform Versions
Siemens Solid Edge Se2020	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Solid Edge Se2021 Firmware	Before se2021mp5

Running on/with	Platform Versions
Siemens Solid Edge Se2021	All versions

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09

Source: productcert@siemens.com

Third Party AdvisoryUS Government Resource

https://www.zerodayinitiative.com/advisories/ZDI-21-999/

Source: productcert@siemens.com

Third Party AdvisoryVDB Entry

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-09

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.zerodayinitiative.com/advisories/ZDI-21-999/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.