Vulnerability · Published Dec 14, 2021 · Assigned by siemens
CVE-2021-42023
Medium 6.5
In plain English
A medium-severity security flaw in ModelSim Simulation from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected applications insufficiently protects the built-in private keys that are required to decrypt electronic intellectual property (IP) data in accordance with the IEEE 1735 recommended practice. This could allow a sophisticated attacker to discover the keys, bypassing the protection intended by the IEEE 1735 recommended practice.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | ModelSim Simulation | All versions |
| Siemens | Questa Simulation | All versions |
Weakness: CWE-522