CVE-2024-54095: Siemens Solid Edge SE2024 RCE Vulnerability

CVE-2024-54095 Overview

CVE-2024-54095 is an integer underflow vulnerability [CWE-191] in Siemens Solid Edge SE2024, a computer-aided design (CAD) application. All versions before V224.0 Update 10 are affected. The flaw occurs when the application parses specially crafted PAR files, and it can be triggered to execute code in the context of the current process. Exploitation requires local access and user interaction, typically opening a malicious PAR file supplied by an attacker.

Critical Impact
A crafted PAR file processed by Solid Edge SE2024 can trigger arbitrary code execution as the user running the application, compromising engineering workstations and intellectual property.

Affected Products

Siemens Solid Edge SE2024 — all versions before V224.0 Update 10
Siemens Solid Edge SE2024 V224.0 base release through Update 0009
Engineering workstations processing Solid Edge PAR (part) files

Discovery Timeline

2024-12-10 - CVE-2024-54095 published to NVD
2024-12-10 - Siemens publishes advisory SSA-730188
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54095

Vulnerability Analysis

The vulnerability is an integer underflow in the PAR file parser of Solid Edge SE2024. PAR files are the native part-model format used by the application and contain structured binary data describing geometry, features, and metadata. When the parser processes size or length fields derived from attacker-controlled data, an arithmetic operation wraps below zero and produces a very large unsigned value. That value is then used in downstream buffer or loop calculations, leading to out-of-bounds memory access and corruption of process state.

Because the resulting memory corruption can be steered, an attacker who controls the PAR file contents can hijack control flow inside the Solid Edge process. Code executes with the privileges of the user opening the file, which on engineering workstations typically includes access to design assets, network shares, and connected PLM systems.

Root Cause

The root cause is missing validation of a length or count field prior to arithmetic in the PAR parsing routines. A subtraction against an attacker-influenced value underflows the integer type, and the resulting value is trusted by later allocation or copy logic. This is the classic pattern behind [CWE-191: Integer Underflow (Wrap or Wraparound)].

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted .par file through email, a shared drive, a supplier data exchange, or a compromised project archive. When an engineer opens the file in Solid Edge SE2024, the parser triggers the underflow and executes attacker-supplied code in the context of the current user. No network exposure is required, and no elevated privileges are needed prior to exploitation.

No public proof-of-concept exploit is currently listed, and the CVE is not present in the CISA Known Exploited Vulnerabilities catalog. Refer to the Siemens Security Advisory SSA-730188 for vendor technical detail.

Detection Methods for CVE-2024-54095

Indicators of Compromise

Unexpected child processes spawned by Edge.exe or other Solid Edge binaries immediately after opening a PAR file
Solid Edge process crashes or access-violation events correlated with the load of a specific .par file
PAR files arriving from untrusted senders or unusual paths (email attachments, downloads, removable media) followed by process anomalies
Outbound network connections initiated by the Solid Edge process to unfamiliar hosts

Detection Strategies

Monitor for anomalous child-process creation from Solid Edge executables, especially shells, script interpreters, or LOLBins such as powershell.exe, cmd.exe, rundll32.exe, and mshta.exe
Alert on Windows Error Reporting or crash-dump events referencing Solid Edge modules, which may indicate exploitation attempts or fuzzing
Inspect file metadata and origin of .par files handled by CAD users, and flag files sourced from untrusted external channels

Monitoring Recommendations

Enable EDR telemetry on all engineering workstations running Solid Edge and forward process, file, and module-load events to a central data lake for retention
Baseline normal Solid Edge behavior (typical child processes, file paths, network destinations) to make anomalies detectable
Correlate PAR file arrival, first-open events, and subsequent process behavior in a single timeline to identify exploitation attempts

How to Mitigate CVE-2024-54095

Immediate Actions Required

Upgrade Solid Edge SE2024 to V224.0 Update 10 or later on all engineering workstations
Inventory endpoints running vulnerable Solid Edge versions using software asset management and prioritize CAD and PLM users
Block or quarantine .par files received from untrusted external sources at the email and web gateway until patching is complete
Instruct engineering users not to open PAR files from unknown senders or unverified project archives

Patch Information

Siemens has released Solid Edge SE2024 V224.0 Update 10, which remediates the integer underflow in the PAR file parser. Full details, download instructions, and additional guidance are available in the Siemens Security Advisory SSA-730188.

Workarounds

Restrict Solid Edge to opening PAR files from trusted, internally controlled repositories only
Run Solid Edge under a standard user account (no local administrator rights) to limit post-exploitation impact
Apply application allow-listing to prevent Solid Edge from spawning script interpreters or unexpected child processes
Segment engineering workstations from general corporate networks to contain compromise of a CAD host

bash

# Example: query installed Solid Edge version on Windows to confirm patch level
reg query "HKLM\SOFTWARE\Siemens\Solid Edge\Version 224" /v Version

# Example: block inbound .par attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block-External-PAR" \
  -FromScope NotInOrganization \
  -AttachmentExtensionMatchesWords "par" \
  -RejectMessageReasonText "External PAR files are blocked pending review."