CVE-2024-33490: Siemens Solid Edge SE2024 RCE Vulnerability

CVE-2024-33490 Overview

CVE-2024-33490 is an out-of-bounds read vulnerability affecting Siemens Solid Edge SE2024 versions prior to V224.0 Update 5. The flaw resides in the application's parser for PAR files, a proprietary Solid Edge part file format. When Solid Edge processes a specially crafted PAR file, the parser reads memory past the end of an allocated structure, which can lead to arbitrary code execution in the context of the current user.

Exploitation requires local access and user interaction, typically by convincing a user to open a malicious PAR file. The weakness is classified as [CWE-125] (Out-of-bounds Read).

Critical Impact
Successful exploitation allows an attacker to execute code in the context of the Solid Edge process, compromising the confidentiality, integrity, and availability of engineering data on the affected workstation.

Affected Products

Siemens Solid Edge SE2024, all versions prior to V224.0 Update 5
Siemens Solid Edge SE2024 V224.0 base release and Update 0001 through Update 0004
Engineering workstations processing untrusted PAR files with vulnerable Solid Edge builds

Discovery Timeline

2024-05-14 - CVE-2024-33490 published to NVD alongside Siemens advisory SSA-589937
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33490

Vulnerability Analysis

The vulnerability exists in Solid Edge's file parsing routine for PAR (part) files. When the application reads a malformed PAR file, the parser dereferences memory locations beyond the boundary of an allocated buffer or structure. This out-of-bounds read exposes adjacent process memory and can be leveraged to disclose sensitive data or corrupt program state used in later control flow decisions.

Attackers craft PAR files with manipulated structure fields (such as size, count, or offset values) that cause the parser to advance its read cursor past the allocation. Depending on the memory layout at exploitation time, the attacker can steer execution to attacker-controlled data and achieve code execution under the user's privileges.

Because Solid Edge runs with the privileges of the interactive user, successful exploitation grants those same privileges, which on engineering workstations frequently include access to sensitive CAD assets, intellectual property, and network file shares.

Root Cause

The root cause is insufficient bounds validation on fields inside PAR files prior to using those fields to index into or iterate over parsed structures. The parser trusts length and offset values from the file rather than validating them against the actual allocation size.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted PAR file through email, a shared drive, a supplier portal, or a compromised design collaboration workflow. When the user opens the file in Solid Edge, the parser processes the malicious structure and triggers the out-of-bounds read, enabling code execution in the current process.

No authentication is required to craft the file, and no elevated privileges are needed on the target host beyond the ability to open Solid Edge.

See the Siemens Security Advisory SSA-589937 for vendor-supplied technical detail.

Detection Methods for CVE-2024-33490

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries associated with the Solid Edge process shortly after opening a PAR file
PAR files arriving from unverified external sources, particularly via email attachments or unmanaged file shares
Solid Edge processes spawning unusual child processes such as cmd.exe, powershell.exe, or scripting engines
Outbound network connections initiated by Solid Edge to non-corporate destinations following file open events

Detection Strategies

Monitor for anomalous child process creation from Solid Edge executables on engineering workstations
Alert on Solid Edge process crashes correlated with recent PAR file access events
Inspect email and file share gateways for PAR attachments originating outside trusted engineering supply chains
Correlate file open telemetry with subsequent process, registry, or network anomalies on the same host

Monitoring Recommendations

Maintain endpoint telemetry on all engineering workstations running Solid Edge, including process, file, and network events
Track Solid Edge version inventory to identify hosts still running builds prior to V224.0 Update 5
Log and review PAR file transfers across DLP and web proxy controls
Review user reports of Solid Edge instability, which may indicate exploitation attempts against the parser

How to Mitigate CVE-2024-33490

Immediate Actions Required

Upgrade Siemens Solid Edge SE2024 to V224.0 Update 5 or later on all affected workstations
Restrict opening of PAR files to those originating from trusted internal projects and verified suppliers
Educate CAD users on the risk of opening unsolicited PAR attachments or files from unknown sources
Isolate engineering workstations from general-purpose email and browsing where feasible

Patch Information

Siemens has released Solid Edge SE2024 V224.0 Update 5, which remediates the out-of-bounds read in the PAR file parser. Administrators should deploy the update through their standard Solid Edge distribution channel and confirm the installed version on each host. Refer to Siemens Security Advisory SSA-589937 for authoritative patch guidance.

Workarounds

Avoid opening PAR files received from untrusted sources until the patch is deployed
Enforce application allowlisting so that Solid Edge cannot spawn unexpected interpreters or shells
Apply least-privilege principles so users running Solid Edge do not hold local administrator rights
Segment engineering networks to limit lateral movement if a workstation is compromised

bash

# Verify installed Solid Edge version on Windows workstations
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Current Version" /v "Version"

# Block PAR attachments at the mail gateway (example rule syntax)
# attachment.extension == "par" AND sender.domain NOT IN trusted_supplier_list