CVE-2024-54093: Siemens Solid Edge Buffer Overflow Flaw

CVE-2024-54093 Overview

CVE-2024-54093 is a heap-based buffer overflow vulnerability affecting Siemens Solid Edge SE2024, a computer-aided design (CAD) application widely used in manufacturing and engineering. The flaw exists in the ASM file parser and impacts all versions prior to V224.0 Update 5. An attacker who convinces a user to open a specially crafted ASM file can trigger memory corruption on the heap. Successful exploitation allows arbitrary code execution in the context of the current Solid Edge process. Siemens documented the issue in advisory SSA-730188. The vulnerability maps to [CWE-122] Heap-based Buffer Overflow and [CWE-787] Out-of-bounds Write.

Critical Impact
Attackers can execute arbitrary code on engineering workstations by delivering a malicious ASM file, potentially compromising intellectual property and pivoting into OT environments.

Affected Products

Siemens Solid Edge SE2024 — all versions before V224.0 Update 5
Siemens Solid Edge SE2024 V224.0 base release through Update 0004
CAD workstations running vulnerable ASM parsing components

Discovery Timeline

2024-12-10 - CVE-2024-54093 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54093

Vulnerability Analysis

The vulnerability resides in the ASM file parsing logic within Solid Edge SE2024. ASM files describe assembly structures composed of multiple parts and references, and the parser processes structured records that include length-prefixed fields and object descriptors. When Solid Edge processes a malformed ASM file, the parser writes attacker-controlled data beyond an allocated heap buffer.

The result is heap memory corruption. An attacker who controls the overflowing bytes can overwrite adjacent heap metadata, function pointers, or object virtual tables reachable from the CAD process. Exploitation runs code with the privileges of the user opening the file, which on engineering workstations is often elevated for local design work.

The attack requires user interaction. A victim must open or import the crafted ASM file, typically delivered via email, shared network drives, or supplier file exchanges common in engineering workflows.

Root Cause

The root cause is missing or insufficient bounds validation on size fields inside ASM file records. The parser trusts attacker-supplied length values and copies content into a fixed or under-sized heap allocation. This combination of [CWE-122] and [CWE-787] behavior enables an out-of-bounds write on the heap.

Attack Vector

The attack vector is local and file-based. An attacker crafts a malicious ASM file, delivers it to a target engineer, and relies on the user opening it in Solid Edge SE2024. No network exposure is required, but supply-chain delivery through shared CAD repositories or partner file exchanges is realistic in manufacturing environments.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.211%.

Detection Methods for CVE-2024-54093

Indicators of Compromise

Unexpected crashes of Edge.exe or related Solid Edge processes shortly after opening an ASM file
Windows Error Reporting entries citing access violations or heap corruption in Solid Edge modules
ASM files arriving from untrusted senders, external suppliers, or web downloads outside normal engineering workflows
Child processes spawned by Solid Edge that do not match normal CAD activity, such as cmd.exe, powershell.exe, or rundll32.exe

Detection Strategies

Monitor process creation events where Solid Edge is the parent and the child is a scripting or living-off-the-land binary
Alert on module loads or memory allocations in Solid Edge with RWX permissions inconsistent with normal operation
Inspect ASM files at email and file-share gateways for malformed structural records or abnormal size fields

Monitoring Recommendations

Enable and forward Sysmon process, image load, and file creation events from engineering workstations to a central SIEM
Track file open telemetry for ASM extensions and correlate with subsequent process anomalies
Review crash dumps of Solid Edge for signatures consistent with heap corruption in the ASM parser

How to Mitigate CVE-2024-54093

Immediate Actions Required

Upgrade Solid Edge SE2024 to V224.0 Update 5 or later on all engineering workstations
Restrict opening of ASM files received from external or untrusted sources until patching is complete
Inventory workstations running Solid Edge SE2024 and prioritize those handling files from third-party suppliers
Educate CAD users on the risk of opening unsolicited ASM attachments

Patch Information

Siemens has released a fixed version. Update Solid Edge SE2024 to V224.0 Update 5 or newer. Full remediation details are documented in the Siemens Security Advisory SSA-730188.

Workarounds

Only open ASM files from trusted, verified sources and internal repositories
Use application allowlisting to prevent Solid Edge from spawning shells or scripting interpreters
Run Solid Edge under a standard user account rather than an administrator account where feasible
Isolate engineering workstations from general-purpose networks and OT segments

bash

# Verify installed Solid Edge SE2024 version on Windows
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version 224" /v "Version"

# Block ASM attachments from untrusted senders at the mail gateway (example policy fragment)
# rule: if attachment.extension == "asm" and sender.domain not in trusted_partners: quarantine