Vulnerability · Published May 27, 2021 · Assigned by icscert

CVE-2021-27492

Medium 5.5

In plain English

A medium-severity XML external entity in Datakit Software libraries embedded in Luxion KeyShot software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities).

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)1.7%top 22.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.

Affected products (as reported)

Vendor	Product	Versions
n/a	Datakit Software libraries embedded in Luxion KeyShot software	CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior

Weakness: CWE-611

References

https://www.zerodayinitiative.com/advisories/ZDI-21-567/ x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/ssa-119468.pdf x_refsource_CONFIRM
https://us-cert.cisa.gov/ics/advisories/icsa-21-145-01 x_refsource_MISC