CVE-2023-25140
Full vulnerability record from the local CVENow database.
Description
A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.254), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150), Solid Edge SE2022 (All versions < V222.0MP12). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-02-14 11:15:17.927000
Last modified
2026-10-23 23:10:00.157000
View original CVE JSON
{
"id": "CVE-2023-25140",
"sourceIdentifier": "[email protected]",
"published": "2023-02-14T11:15:17.927",
"lastModified": "2026-10-23T23:10:00.157",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.254), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150), Solid Edge SE2022 (All versions < V222.0MP12). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process."
},
{
"lang": "es",
"value": "Una vulnerabilidad ha sido identificada en Parasolid V34.0 (Todas las versiones anteriores a V34.0.254), Parasolid V34.1 (Todas las versiones anteriores a V34.1.242), Parasolid V35.0 (Todas las versiones anteriores a V35.0.170), Parasolid V35.1 (Todas las versiones anteriores a V35.1.150), Solid Edge SE2022 (Todas las versiones anteriores a V222.0MP12). Las aplicaciones afectadas contienen una lectura fuera de límites más allá del final de una estructura asignada mientras se analizan archivos PAR especialmente manipulados. Esto podría permitir a un atacante ejecutar código en el contexto del proceso actual."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Siemens",
"product": "Parasolid V34.0",
"defaultStatus": "unknown",
"versions": [
{
"version": "All versions < V34.0.254",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "Parasolid V34.1",
"defaultStatus": "unknown",
"versions": [
{
"version": "All versions < V34.1.242",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "Parasolid V35.0",
"defaultStatus": "unknown",
"versions": [
{
"version": "All versions < V35.0.170",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "Parasolid V35.1",
"defaultStatus": "unknown",
"versions": [
{
"version": "All versions < V35.1.150",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "Solid Edge SE2022",
"defaultStatus": "unknown",
"versions": [
{
"version": "All versions < V222.0MP12",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-03-19T18:53:27.859268Z",
"id": "CVE-2023-25140",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*",
"versionStartIncluding": "34.0",
"versionEndExcluding": "34.0.254",
"matchCriteriaId": "381AD2E7-0F3D-4510-9DDB-8A2551C7BB7F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*",
"versionStartIncluding": "34.1",
"versionEndExcluding": "34.1.242",
"matchCriteriaId": "4C486991-A1C0-4815-AAD6-163464D711AA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*",
"versionStartIncluding": "35.0",
"versionEndExcluding": "35.0.170",
"matchCriteriaId": "EA2114FD-BB07-4C24-98B1-928A510565BB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*",
"versionStartIncluding": "35.1",
"versionEndExcluding": "35.1.150",
"matchCriteriaId": "5C98612B-63DF-473C-AF6E-CF3740356D5B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:siemens:solid_edge:se2022:-:*:*:*:*:*:*",
"matchCriteriaId": "61866294-2060-457C-9CBE-8AEAF03973F6"
}
]
}
]
}
],
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-836777.pdf",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-836777.pdf",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
}
]
}