{"api_version":"1","generated_at":"2026-07-23T12:12:21+00:00","cve":"CVE-2020-28381","urls":{"html":"https://cve.report/CVE-2020-28381","api":"https://cve.report/api/cve/CVE-2020-28381.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-28381","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-28381"},"summary":{"title":"CVE-2020-28381","description":"A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process.","state":"PUBLIC","assigner":"productcert@siemens.com","published_at":"2021-01-12 21:15:00","updated_at":"2021-12-10 21:47:00"},"problem_types":["CWE-787"],"metrics":[],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-074/","name":"https://www.zerodayinitiative.com/advisories/ZDI-21-074/","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"ZDI-21-074 | Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-053/","name":"https://www.zerodayinitiative.com/advisories/ZDI-21-053/","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"ZDI-21-053 | Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04","name":"https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04","refsource":"MISC","tags":["Third Party Advisory","US Government Resource"],"title":"Siemens Solid Edge | CISA","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-048/","name":"https://www.zerodayinitiative.com/advisories/ZDI-21-048/","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"ZDI-21-048 | Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf","name":"https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf","refsource":"MISC","tags":["Vendor Advisory"],"title":"","mime":"application/pdf","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28381","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28381","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack10","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack11","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack6","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack7","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack8","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2020","cpe7":"maintenance_pack9","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2021","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2021","cpe7":"maintenance_pack1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2021","cpe7":"mp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"se2021","cpe7":"mp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28381","vulnerable":"1","versionEndIncluding":"se2021","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"siemens","cpe5":"solid_edge","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"productcert@siemens.com","ID":"CVE-2020-28381","STATE":"PUBLIC"},"data_format":"MITRE","data_version":"4.0","data_type":"CVE","affects":{"vendor":{"vendor_data":[{"vendor_name":"Siemens","product":{"product_data":[{"product_name":"Solid Edge SE2020","version":{"version_data":[{"version_value":"All Versions < SE2020MP12"}]}},{"product_name":"Solid Edge SE2021","version":{"version_data":[{"version_value":"All Versions < SE2021MP2"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-787: Out-of-bounds Write"}]}]},"description":{"description_data":[{"lang":"eng","value":"A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process."}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf","name":"https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf"},{"refsource":"MISC","name":"https://www.zerodayinitiative.com/advisories/ZDI-21-048/","url":"https://www.zerodayinitiative.com/advisories/ZDI-21-048/"},{"refsource":"MISC","name":"https://www.zerodayinitiative.com/advisories/ZDI-21-053/","url":"https://www.zerodayinitiative.com/advisories/ZDI-21-053/"},{"refsource":"MISC","name":"https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04","url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04"},{"refsource":"MISC","name":"https://www.zerodayinitiative.com/advisories/ZDI-21-074/","url":"https://www.zerodayinitiative.com/advisories/ZDI-21-074/"}]}},"nvd":{"publishedDate":"2021-01-12 21:15:00","lastModifiedDate":"2021-12-10 21:47:00","problem_types":["CWE-787"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:-:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*","versionEndExcluding":"se2020","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack2:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack3:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack4:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack5:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack6:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack7:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack8:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack9:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack10:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack11:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"28381","Ordinal":"190868","Title":"CVE-2020-28381","CVE":"CVE-2020-28381","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"28381","Ordinal":"1","NoteData":"A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"28381","Ordinal":"2","NoteData":"2021-01-12","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"28381","Ordinal":"3","NoteData":"2021-02-09","Type":"Other","Title":"Modified"}]}}}