# Siemens Solid Edge PAR and CFG parsing vulnerabilities

Published: 2025-07-10 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/3a4cf677-6798-596d-999c-4d583ce28485/siemens-solid-edge-par-and-cfg-parsing-vulnerabilities

> Three memory-corruption flaws in Solid Edge SE2025 allow arbitrary code execution when parsing untrusted PAR or CFG files.

Siemens Solid Edge SE2025 contains three memory-corruption vulnerabilities affecting file parsing. Two out-of-bounds read flaws (CVE-2025-40739, CVE-2025-40740) arise from parsing specially crafted PAR files, while a stack-based buffer overflow (CVE-2025-40741) occurs during CFG file parsing. All three allow arbitrary code execution in the application context. The vulnerabilities require local access and user interaction—opening an untrusted file—making exploitation opportunistic but not remotely weaponizable. CVSS v3.1 scores are 7.8 for each; CVSS v4 base score is 7.3 with high attack complexity. Mitigation requires updating to V225.0 Update 5 or later, or avoiding untrusted file formats. No active exploitation has been reported.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40739, CVE-2025-40740, CVE-2025-40741

## Detection guidance (public sample)

### Solid Edge Spawning Shell or Script Interpreter

ATT&CK: T1204.002

Siemens Solid Edge spawning a command shell, script host or common LOLBin, which may indicate code execution after a malicious PAR/CFG file is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Solid Edge Spawning Shell or Script Interpreter
id: 8132d61e-1941-5693-8ec0-84118bd95533
status: experimental
description: Detects Siemens Solid Edge spawning a command shell, script host or common
  LOLBin. Memory-corruption flaws in PAR/CFG file parsing (CVE-2025-40739/40740/40741)
  give code execution in the application context, and post-exploitation commonly launches
  child processes from the CAD process.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \Solid Edge
    ParentImage|endswith: \Edge.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- Solid Edge add-ins or macros that legitimately invoke cmd.exe or PowerShell for
  automation
- Installer or licensing helper routines launched from the Solid Edge process
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-02
```

### Solid Edge Dropping Executable or Script in User-Writable Path

ATT&CK: T1204.002

Siemens Solid Edge process writing executable or script content to temp, AppData or Public folders, a possible payload drop after exploitation via a malicious file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Solid Edge Dropping Executable or Script in User-Writable Path
id: 128834ac-2e17-56ab-965f-0b150f39a07a
status: experimental
description: Detects the Solid Edge process creating executable or script files in
  user-writable locations. After exploitation of PAR/CFG parsing vulnerabilities,
  shellcode commonly drops a secondary payload to disk.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|contains: \Solid Edge
    Image|endswith: \Edge.exe
  selection_target_path:
    TargetFilename|contains:
    - \AppData\Local\Temp\
    - \AppData\Roaming\
    - \Users\Public\
    - \ProgramData\
  selection_target_ext:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .vbs
    - .js
    - .bat
    - .scr
  condition: selection_image and selection_target_path and selection_target_ext
falsepositives:
- Solid Edge extracting temporary DLLs or helper binaries into the temp folder during
  updates or add-in loading
- Third-party CAD add-ins writing runtime components to AppData
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3a4cf677-6798-596d-999c-4d583ce28485/siemens-solid-edge-par-and-cfg-parsing-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup