CVE-2024-33491: Siemens Solid Edge SE2024 RCE Vulnerability

CVE-2024-33491 Overview

CVE-2024-33491 is an out-of-bounds read vulnerability in Siemens Solid Edge SE2024, affecting all versions prior to V224.0 Update 5. The flaw resides in the PAR file parser, which reads past the end of an allocated structure when processing specially crafted PAR files. An attacker who convinces a user to open a malicious PAR file can execute arbitrary code in the context of the current process. Siemens disclosed the issue in advisory SSA-589937 and released V224.0 Update 5 as the remediation. The weakness is tracked as CWE-125.

Critical Impact

Successful exploitation allows local code execution with the privileges of the Solid Edge user, potentially compromising engineering workstations and design intellectual property.

Affected Products

• Siemens Solid Edge SE2024 — all versions prior to V224.0 Update 5
• Siemens Solid Edge SE2024 V224.0 base release, Update 0001, Update 0002, Update 0003, Update 0004
• Any workstation opening untrusted PAR (Solid Edge Part) files with an affected client

Discovery Timeline

• 2024-05-14 - CVE-2024-33491 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33491

Vulnerability Analysis

The vulnerability is an out-of-bounds read past the end of an allocated structure while parsing PAR files, Solid Edge's native part geometry format. The parser trusts embedded length or offset fields without validating them against the actual size of the allocated buffer. When a crafted PAR file supplies oversized or malformed structure descriptors, the parser reads adjacent heap memory. Attackers can pair this primitive with heap grooming to influence which data lands next to the target buffer. Reading attacker-controlled memory layouts enables leaking pointers, bypassing address space layout randomization, and chaining to memory corruption primitives that lead to code execution in the Solid Edge process.

Root Cause

The root cause is missing bounds checking during deserialization of PAR file structures, classified under CWE-125: Out-of-bounds Read. The parser dereferences pointers or performs sequential reads using untrusted size fields from the file itself. Because the read extends past the allocated object, it accesses memory that may contain sensitive process state or corrupt subsequent parsing logic.

Attack Vector

Exploitation requires local file interaction. An attacker delivers a malicious PAR file through phishing, a shared engineering repository, a supplier bundle, or a removable device. When a user opens the file in Solid Edge, the vulnerable parser processes attacker-controlled data. No network exposure or elevated privileges are required, and the resulting code execution runs with the user's rights. Engineering workstations often hold proprietary CAD models and credentials to product lifecycle management systems, making them high-value targets.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Detection Methods for CVE-2024-33491

Indicators of Compromise

• Unexpected crashes of Edge.exe or related Solid Edge processes shortly after opening a PAR file
• PAR files arriving from untrusted email senders, external file shares, or unusual USB devices
• Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by the Solid Edge process
• Outbound network connections initiated by Solid Edge to unfamiliar hosts following file open events

Detection Strategies

• Monitor for anomalous process lineage where Solid Edge spawns interpreters, script hosts, or LOLBins
• Alert on Windows Error Reporting (WER) or application crash events referencing Solid Edge modules
• Inspect PAR files at email and web gateways, quarantining files from external or unverified sources
• Correlate file-open telemetry with sudden memory allocation spikes or exception handling in the CAD process

Monitoring Recommendations

• Enable command-line and process-creation auditing on engineering workstations running Solid Edge
• Forward endpoint telemetry to a centralized SIEM or data lake for retrospective hunting on .par file activity
• Track Solid Edge version inventory to identify hosts still running builds prior to V224.0 Update 5
• Review file access logs on CAD repositories for unusual bursts of PAR file uploads from a single user or account

How to Mitigate CVE-2024-33491

Immediate Actions Required

• Upgrade Solid Edge SE2024 to V224.0 Update 5 or later on all engineering workstations
• Restrict opening of PAR files to those from verified internal projects and trusted suppliers
• Educate CAD users about the risk of opening unsolicited PAR files, particularly from email attachments
• Apply application allowlisting so only signed, expected binaries can execute from user-writable paths

Patch Information

Siemens has released Solid Edge SE2024 V224.0 Update 5, which resolves the out-of-bounds read in the PAR file parser. Refer to the Siemens Security Advisory SSA-589937 for download instructions, affected build numbers, and additional CVEs addressed in the same release.

Workarounds

• Avoid opening PAR files received from untrusted sources until the update is applied
• Sandbox Solid Edge on shared or high-risk workstations using OS-level exploit protection and controlled folder access
• Segment engineering workstations from general corporate networks to limit lateral movement after compromise
• Enforce least-privilege user rights so a compromised Solid Edge session cannot install persistent malware

# Verify installed Solid Edge version on Windows workstations
powershell -Command "Get-ItemProperty 'HKLM:\SOFTWARE\Siemens\Solid Edge\Version 224\Install' | Select-Object InstalledVersion, InstallDir"