CVEvulnerability

CVE-2021-22645

7.8 HIGH Published 2021-02-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-02-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-357

Description

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll from a remote network share. As a result, the .dll entry point can be executed without sufficient UI warning.

Affected configurations

• luxion keyshot (< 10.1) • luxion keyshot network rendering (< 10.1) • luxion keyshot viewer (< 10.1) • luxion keyvr (< 10.1) • siemens solid edge se2020 firmware • siemens solid edge se2021 firmware

Related

Weakness · CWE (1)

  • CWE-357 Insufficient UI Warning of Dangerous Operations weakness

References