cvelistv5 - cve-2021-27041

▼	URL	Tags
	psirt@autodesk.com	https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007	Vendor Advisory

ghsa-6wwm-622g-84wc

Vulnerability from github

Published

2022-05-24 19:06

Modified

2022-05-24 19:06

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-27041"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-25T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code.",
  "id": "GHSA-6wwm-622g-84wc",
  "modified": "2022-05-24T19:06:19Z",
  "published": "2022-05-24T19:06:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27041"
    },
    {
      "type": "WEB",
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0004"
    },
    {
      "type": "WEB",
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1237"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-478"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

ICSA-21-294-01

Vulnerability from csaf_cisa

Published

2021-10-21 00:00

Modified

2021-10-21 00:00

Summary

ICONICS GENESIS64 and Mitsubishi Electric MC Works64

Notes

CISA Disclaimer

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation

Successful exploitation of these vulnerabilities may result in remote code execution.

Critical infrastructure sectors

Multiple including Critical Manufacturing

Countries/areas deployed

Worldwide

Company headquarters location

ICONICS is headquartered in the United States. Mitsubishi Electric is headquartered in Japan.

Recommended Practices

CISA recommends users take the following measures to protect themselves from social engineering attacks:

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

Exploitability

No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Michael DePlante"
        ],
        "organization": "Trend Micro \u0027s Zero Day Initiative",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities may result in remote code execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Multiple including Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "ICONICS is headquartered in the United States. Mitsubishi Electric is headquartered in Japan.",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-294-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-294-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-294-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-294-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/ncas/tips/ST04-014"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICONICS GENESIS64 and Mitsubishi Electric MC Works64",
    "tracking": {
      "current_release_date": "2021-10-21T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-21-294-01",
      "initial_release_date": "2021-10-21T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2021-10-21T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-21-294-01 ICONICS GENESIS64 and Mitsubishi Electric MC Works64"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 10.97",
                "product": {
                  "name": "GENESIS64: (all versions up to and including 10.97)",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 4.04E",
                "product": {
                  "name": "MC Works64: (all version of MC Works64 up to and including Version 4.04E)",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "MC Works64"
          }
        ],
        "category": "vendor",
        "name": "ICONICS, Mitsubishi Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27041",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A lack of proper validation of user-supplied data may result in a write past the end of an allocated data structure. User interaction is required to exploit this vulnerability as the target must attempt to import a malicious AutoCAD DWG file into GraphWorX64.CVE-2021-27041 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-27041"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing Critical Fix Rollups or patches for these products. GENESIS64 Version 10.97.1 and later will not be vulnerable to this exploit.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "Use a firewall. Place control system networks and devices behind firewalls and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all control system devices. Control system devices should not directly face the Internet.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click web links or open unsolicited attachments in email messages.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "When importing any AutoCad DWG file, make sure it is known to come from a trusted source.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Install the applicable Critical Fix Rollup, when available.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "ICONICS provides information and useful links related to its security updates at its company website.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric provides information and useful links related to this security update at its company website.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-017_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-27040",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A lack of proper validation of user-supplied data may allow reading past the end of an allocated data structure. User interaction is required to exploit this vulnerability as the target must visit a malicious page or open a malicious file.CVE-2021-27040 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-27040"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing Critical Fix Rollups or patches for these products. GENESIS64 Version 10.97.1 and later will not be vulnerable to this exploit.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "Use a firewall. Place control system networks and devices behind firewalls and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all control system devices. Control system devices should not directly face the Internet.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click web links or open unsolicited attachments in email messages.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "When importing any AutoCad DWG file, make sure it is known to come from a trusted source.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Install the applicable Critical Fix Rollup, when available.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "ICONICS provides information and useful links related to its security updates at its company website.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric provides information and useful links related to this security update at its company website.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-017_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    }
  ]
}

icsa-21-294-01

Vulnerability from csaf_cisa

Published

2021-10-21 00:00

Modified

2021-10-21 00:00

Summary

ICONICS GENESIS64 and Mitsubishi Electric MC Works64

Notes

CISA Disclaimer

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation

Successful exploitation of these vulnerabilities may result in remote code execution.

Critical infrastructure sectors

Multiple including Critical Manufacturing

Countries/areas deployed

Worldwide

Company headquarters location

ICONICS is headquartered in the United States. Mitsubishi Electric is headquartered in Japan.

Recommended Practices

CISA recommends users take the following measures to protect themselves from social engineering attacks:

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

Exploitability

No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Michael DePlante"
        ],
        "organization": "Trend Micro \u0027s Zero Day Initiative",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities may result in remote code execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Multiple including Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "ICONICS is headquartered in the United States. Mitsubishi Electric is headquartered in Japan.",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-294-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-294-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-294-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-294-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/ncas/tips/ST04-014"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICONICS GENESIS64 and Mitsubishi Electric MC Works64",
    "tracking": {
      "current_release_date": "2021-10-21T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-21-294-01",
      "initial_release_date": "2021-10-21T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2021-10-21T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-21-294-01 ICONICS GENESIS64 and Mitsubishi Electric MC Works64"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 10.97",
                "product": {
                  "name": "GENESIS64: (all versions up to and including 10.97)",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "GENESIS64"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 4.04E",
                "product": {
                  "name": "MC Works64: (all version of MC Works64 up to and including Version 4.04E)",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "MC Works64"
          }
        ],
        "category": "vendor",
        "name": "ICONICS, Mitsubishi Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-27041",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A lack of proper validation of user-supplied data may result in a write past the end of an allocated data structure. User interaction is required to exploit this vulnerability as the target must attempt to import a malicious AutoCAD DWG file into GraphWorX64.CVE-2021-27041 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-27041"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing Critical Fix Rollups or patches for these products. GENESIS64 Version 10.97.1 and later will not be vulnerable to this exploit.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "Use a firewall. Place control system networks and devices behind firewalls and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all control system devices. Control system devices should not directly face the Internet.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click web links or open unsolicited attachments in email messages.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "When importing any AutoCad DWG file, make sure it is known to come from a trusted source.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Install the applicable Critical Fix Rollup, when available.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "ICONICS provides information and useful links related to its security updates at its company website.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric provides information and useful links related to this security update at its company website.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-017_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-27040",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A lack of proper validation of user-supplied data may allow reading past the end of an allocated data structure. User interaction is required to exploit this vulnerability as the target must visit a malicious page or open a malicious file.CVE-2021-27040 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-27040"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "ICONICS and Mitsubishi Electric are releasing Critical Fix Rollups or patches for these products. GENESIS64 Version 10.97.1 and later will not be vulnerable to this exploit.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "Use a firewall. Place control system networks and devices behind firewalls and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all control system devices. Control system devices should not directly face the Internet.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not click web links or open unsolicited attachments in email messages.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "When importing any AutoCad DWG file, make sure it is known to come from a trusted source.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Install the applicable Critical Fix Rollup, when available.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "ICONICS provides information and useful links related to its security updates at its company website.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "http://www.iconics.com/certs"
        },
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric provides information and useful links related to this security update at its company website.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-017_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    }
  ]
}

var-202106-1814

Vulnerability from variot

A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code. Provided by Mitsubishi Electric Corporation GENESIS64 and MC Works64 of AutoCAD (DWG) The file import feature contains several vulnerabilities: It was * Out-of-bounds read (CWE-125) - CVE-2021-27040 ‥ * Out-of-bounds writing (CWE-787) - CVE-2021-27041 This vulnerability information is provided by the developer for the purpose of disseminating it to product users. JPCERT/CC Report to JPCERT/CC Coordinated with the developers. Crafted by a third party AutoCAD (DWG) Information leaks by importing the file into the product - CVE-2021-27040 Crafted by a third party AutoCAD (DWG) By importing the file into the product, any program will be executed. - CVE-2021-27041. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202106-1814",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "autocad",
        "scope": null,
        "trust": 2.1,
        "vendor": "autodesk",
        "version": null
      },
      {
        "model": "autocad map 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "autocad map 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "civil 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "civil 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "autocad electrical",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "autocad mechanical",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "civil 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "autocad",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "autocad mep",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "autocad mep",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "autocad map 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "autocad electrical",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "autocad mechanical",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "autocad",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "autocad map 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "autocad plant 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "autocad plant 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "autocad electrical",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "autocad electrical",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "advance steel",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "advance steel",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "civil 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "advance steel",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "autocad architecture",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "autocad lt",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "advance steel",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "autocad",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "autocad",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "civil 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "autocad mechanical",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "autocad electrical",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "autocad",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "autocad plant 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "design review",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2018"
      },
      {
        "model": "autocad electrical",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "autocad mechanical",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "autocad",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "autocad mep",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "autocad map 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "autocad plant 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "autocad architecture",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "autocad lt",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "autocad mep",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "autocad map 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "advance steel",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "civil 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "autocad architecture",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "autocad lt",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "autocad mep",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "mc works64",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "mitsubishielectric",
        "version": "4.04e"
      },
      {
        "model": "autocad plant 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "autocad plant 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "autocad electrical",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "autocad mep",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "advance steel",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "autocad architecture",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "autocad",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "autocad",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "autocad mep",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "autocad plant 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "autocad architecture",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "autocad plant 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "autocad electrical",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "autocad lt",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "autocad lt",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "autocad mechanical",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "autocad architecture",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "autocad mep",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "autocad map 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "autocad architecture",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "autocad lt",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "advance steel",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "autocad mechanical",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022.0.1"
      },
      {
        "model": "autocad lt",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020.1.4"
      },
      {
        "model": "autocad mechanical",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019.1.3"
      },
      {
        "model": "autocad architecture",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "autocad lt",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021"
      },
      {
        "model": "genesis64",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "iconics",
        "version": "10.97"
      },
      {
        "model": "autocad map 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "advance steel",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2020"
      },
      {
        "model": "civil 3d",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2021.1.1"
      },
      {
        "model": "civil 3d",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2022"
      },
      {
        "model": "autocad mechanical",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "autodesk",
        "version": "2019"
      },
      {
        "model": "genesis64",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u4e09\u83f1\u96fb\u6a5f",
        "version": null
      },
      {
        "model": "mc works64",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u4e09\u83f1\u96fb\u6a5f",
        "version": null
      },
      {
        "model": "genesis64",
        "scope": null,
        "trust": 0.7,
        "vendor": "iconics",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:hotfix:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:hotfix2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:hotfix3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:hotfix4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:-:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "10.97",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.04e",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Michael DePlante (@izobashi) of Trend Micro\u0027s Zero Day Initiative",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237"
      }
    ],
    "trust": 2.1
  },
  "cve": "CVE-2021-27041",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2021-27041",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2021-27041",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.8,
            "userInteraction": "REQUIRED",
            "vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2021-27041",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "OTHER",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2021-003350",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "ZDI",
            "id": "CVE-2021-27041",
            "trust": 2.8,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2021-27041",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "OTHER",
            "id": "JVNDB-2021-003350",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-975",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202106-1568",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202106-1568"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code. Provided by Mitsubishi Electric Corporation GENESIS64 and MC Works64 of AutoCAD (DWG) The file import feature contains several vulnerabilities: It was * Out-of-bounds read (CWE-125) - CVE-2021-27040 \u2025 * Out-of-bounds writing (CWE-787) - CVE-2021-27041 This vulnerability information is provided by the developer for the purpose of disseminating it to product users. JPCERT/CC Report to JPCERT/CC Coordinated with the developers.* Crafted by a third party AutoCAD (DWG) Information leaks by importing the file into the product - CVE-2021-27040* Crafted by a third party AutoCAD (DWG) By importing the file into the product, any program will be executed. - CVE-2021-27041. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-27041"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      }
    ],
    "trust": 4.68
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2021-27041",
        "trust": 5.2
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-294-01",
        "trust": 1.4
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-714",
        "trust": 1.3
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237",
        "trust": 1.3
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478",
        "trust": 1.3
      },
      {
        "db": "JVN",
        "id": "JVNVU94862669",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-12281",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-12181",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-14064",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-15565",
        "trust": 0.7
      },
      {
        "db": "CS-HELP",
        "id": "SB2021041363",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021102205",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022042625",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022040706",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2021062421",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.3527",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202106-1568",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202106-1568"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "id": "VAR-202106-1814",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.685964935
  },
  "last_update_date": "2022-05-14T20:19:01.789000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Autodesk has issued an update to correct this vulnerability.",
        "trust": 1.4,
        "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0004"
      },
      {
        "title": "GENESIS64 and MC\u00a0Works64 of AutoCAD(DWG) Information leakage and malicious program execution vulnerability in file import function",
        "trust": 0.8,
        "url": "https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2021-017.pdf"
      },
      {
        "title": "ICONICS has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-294-01"
      },
      {
        "title": "Autodesk has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004"
      },
      {
        "title": "Autodesk AutoCAD Buffer error vulnerability fix",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=155361"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202106-1568"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-787",
        "trust": 1.0
      },
      {
        "problemtype": "Out-of-bounds writing (CWE-787) [ Other ]",
        "trust": 0.8
      },
      {
        "problemtype": " Out-of-bounds read (CWE-125) [ Other ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0004"
      },
      {
        "trust": 2.1,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-294-01"
      },
      {
        "trust": 1.6,
        "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007"
      },
      {
        "trust": 1.2,
        "url": "https://www.zerodayinitiative.com/advisories/zdi-21-1237/"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnvu94862669/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27041"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-27040"
      },
      {
        "trust": 0.7,
        "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021062421"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022040706"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.3527"
      },
      {
        "trust": 0.6,
        "url": "https://www.zerodayinitiative.com/advisories/zdi-22-478/"
      },
      {
        "trust": 0.6,
        "url": "https://www.zerodayinitiative.com/advisories/zdi-21-714/"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022042625"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2021102205"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/iconics-genesis64-three-vulnerabilities-36698"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202106-1568"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202106-1568"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-06-22T00:00:00",
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "date": "2021-06-22T00:00:00",
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "date": "2021-10-28T00:00:00",
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "date": "2022-03-07T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "date": "2021-10-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "date": "2021-04-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2021-06-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202106-1568"
      },
      {
        "date": "2021-06-25T13:15:00",
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-06-22T00:00:00",
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "date": "2021-06-22T00:00:00",
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "date": "2021-10-28T00:00:00",
        "db": "ZDI",
        "id": "ZDI-21-1237"
      },
      {
        "date": "2022-03-07T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-478"
      },
      {
        "date": "2021-11-26T02:40:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-003350"
      },
      {
        "date": "2021-04-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      },
      {
        "date": "2022-04-27T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202106-1568"
      },
      {
        "date": "2022-05-13T17:37:00",
        "db": "NVD",
        "id": "CVE-2021-27041"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202106-1568"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Autodesk AutoCAD DWG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-21-714"
      },
      {
        "db": "ZDI",
        "id": "ZDI-21-713"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-478"
      }
    ],
    "trust": 2.1
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-975"
      }
    ],
    "trust": 0.6
  }
}

gsd-2021-27041

Vulnerability from gsd

Modified

2023-12-13 01:23

Details

A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code

Aliases

CVE-2021-27041

Aliases

CVE-2021-27041

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-27041",
    "description": "A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code.",
    "id": "GSD-2021-27041"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-27041"
      ],
      "details": "A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code",
      "id": "GSD-2021-27041",
      "modified": "2023-12-13T01:23:35.494413Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@autodesk.com",
        "ID": "CVE-2021-27041",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "2022.1.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Out-of-bound Write Vulnerability"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007",
            "refsource": "MISC",
            "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:hotfix:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:hotfix2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:hotfix3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:hotfix4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:design_review:2018:-:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2019.1.3",
                "versionStartIncluding": "2019",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2020.1.4",
                "versionStartIncluding": "2020",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2021.1.1",
                "versionStartIncluding": "2021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022.0.1",
                "versionStartIncluding": "2022",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "10.97",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.04e",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@autodesk.com",
          "ID": "CVE-2021-27041"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-787"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-05-13T17:37Z",
      "publishedDate": "2021-06-25T13:15Z"
    }
  }
}

cve-2021-27041

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature

Action not permitted

cve-2021-27041

Vulnerability from cvelistv5

ghsa-6wwm-622g-84wc

Vulnerability from github

ICSA-21-294-01

Vulnerability from csaf_cisa

icsa-21-294-01

Vulnerability from csaf_cisa

var-202106-1814

Vulnerability from variot

gsd-2021-27041

Vulnerability from gsd

Tags

Sightings

Nomenclature