What’s Vulnerable › Vulnerabilities
CVE-2021-32946
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-06-17 · updated 2026-06-17
- Weakness: CWE-754
Description
An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validation of the user-supplied data. This may result in several of out-of-bounds problems and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.
Affected products
- Open Design Alliance ODA Drawings SDK - All Versions < 2024.12: through 2022.4
- Siemens COMOS: before 10.4.1 — fixed in 10.4.1
- Siemens JT2Go: before 13.2.0.2 — fixed in 13.2.0.2
- Siemens Teamcenter Visualization: before 13.2.0.2 — fixed in 13.2.0.2
How to fix
Upgrade to a fixed version: Siemens COMOS 10.4.1; Siemens JT2Go 13.2.0.2; Siemens Teamcenter Visualization 13.2.0.2. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-938030.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02
- https://www.zerodayinitiative.com/advisories/ZDI-21-983/
- https://www.zerodayinitiative.com/advisories/ZDI-21-985/
- https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-938030.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02
- https://www.zerodayinitiative.com/advisories/ZDI-21-983/
- https://www.zerodayinitiative.com/advisories/ZDI-21-985/
Get alerted when CVE-2021-32946 or the next vulnerability affects your stack