What’s Vulnerable › Vulnerabilities

CVE-2021-27492

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-27 · updated 2026-06-17
• Weakness: CWE-611

Description

When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.

Affected products

• Datakit CrossCAD/Ware_x64 library 0: through 2021.1
• Luxion KeyShot: through 10.1
• Siemens Solid Edge Se2020 Firmware: all versions
• Siemens Solid Edge Se2021 Firmware: all versions

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf
• https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01
• https://www.zerodayinitiative.com/advisories/ZDI-21-567/
• https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf
• https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01
• https://www.zerodayinitiative.com/advisories/ZDI-21-567/

Get alerted when CVE-2021-27492 or the next vulnerability affects your stack