Siemens Solid Edge PRT parsing flaws allow code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Four out-of-bounds vulnerabilities in Siemens Solid Edge let attackers crash the application or execute arbitrary code via malicious PRT files.
Siemens Solid Edge contains four memory safety vulnerabilities in PRT file parsing that affect SE2024 (versions before V224.0 Update 14) and SE2025 (versions before V225.0 Update 6). Two out-of-bounds write flaws (CVE-2025-40809, CVE-2025-40810) and two out-of-bounds read flaws (CVE-2025-40811, CVE-2025-40812) allow local attackers to crash the application or execute arbitrary code in the context of the current process. All four vulnerabilities carry a CVSS v3.1 base score of 7.8, with lower CVSS v4 scores of 7.3 due to requiring user interaction (file opening) and local access. The vulnerabilities are triggered by specially crafted PRT files and do not require authentication or remote network access. No public exploitation has been reported as of the advisory date. Mitigation requires updating to patched versions or avoiding the opening of untrusted PRT files.
Mentioned in this report
Detection guidance
Solid Edge Spawning Shell or Script Interpreter
Solid Edge (Edge.exe) spawning a command shell, script host or LOLBin, as expected after a crafted PRT file triggers code execution in the application process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Solid Edge Spawning Shell or Script Interpreter
description: Detects the Siemens Solid Edge main process (Edge.exe) launching command
interpreters, script hosts or common download/proxy-execution LOLBins. CAD software
has little legitimate need to do this, so it is a strong post-exploitation signal
for memory-corruption bugs in PRT parsing (CVE-2025-40809 to CVE-2025-40812).
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: Solid Edge
ParentImage|endswith: \Edge.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
- \msiexec.exe
condition: selection_parent and selection_child
falsepositives:
- Solid Edge add-ins or installers that shell out to cmd.exe or msiexec.exe during
updates
- Custom automation macros run by CAD administrators
level: high
id: 59fea44e-1a49-5725-b109-dcd7f8964bd4
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-05
Solid Edge Dropping Executable or Script Content in User-Writable Paths
Solid Edge process writing executables, DLLs or scripts to temp, public or ProgramData locations, consistent with shellcode or payload staging after exploiting a malicious PRT file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Solid Edge Dropping Executable or Script Content in User-Writable Paths
description: Detects the Solid Edge main process (Edge.exe) creating executable or
script files in user-writable staging directories. Exploitation of PRT parsing flaws
could be followed by payload staging from the compromised process.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: file_event
product: windows
detection:
selection_proc:
Image|contains: Solid Edge
Image|endswith: \Edge.exe
selection_file:
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .bat
- .vbs
- .js
- .hta
- .scr
selection_path:
TargetFilename|contains:
- \AppData\Local\Temp\
- \Users\Public\
- \ProgramData\
- \AppData\Roaming\
condition: selection_proc and selection_file and selection_path
falsepositives:
- Solid Edge installers or add-in updaters extracting helper DLLs into temp folders
- Third-party CAD plugins that unpack components at first run
level: medium
id: dad13070-1fca-5cc3-9bb7-3e104a495eb9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-05
Solid Edge Opening PRT File From Download or Email Cache Location
Solid Edge launched with a .prt file from a download, temp or email attachment cache path, indicating a user opening an untrusted part file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Solid Edge Opening PRT File From Download or Email Cache Location
description: Detects Solid Edge being started with a PRT file located in browser download,
temp or email attachment cache folders. Opening untrusted PRT files is the user-interaction
step required to trigger CVE-2025-40809 to CVE-2025-40812. Useful as a hunting or
context rule alongside child-process detections.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_proc:
Image|contains: Solid Edge
Image|endswith: \Edge.exe
selection_cmd:
CommandLine|contains: .prt
selection_path:
CommandLine|contains:
- \Downloads\
- \AppData\Local\Temp\
- \Content.Outlook\
- \INetCache\
condition: selection_proc and selection_cmd and selection_path
falsepositives:
- Engineers legitimately opening part files received from suppliers or customers via
email or browser download
- Users opening PRT files extracted to temp by archive tools
level: low
id: 29fd65d7-73c4-56ba-82c8-752ef8561827
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-05
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-05
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs