# Siemens Solid Edge PRT parsing flaws allow code execution

Published: 2025-10-16 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/e6bb4f05-cec8-5a44-bc81-edcd34d849a2/siemens-solid-edge-prt-parsing-flaws-allow-code-execution

> Four out-of-bounds vulnerabilities in Siemens Solid Edge let attackers crash the application or execute arbitrary code via malicious PRT files.

Siemens Solid Edge contains four memory safety vulnerabilities in PRT file parsing that affect SE2024 (versions before V224.0 Update 14) and SE2025 (versions before V225.0 Update 6). Two out-of-bounds write flaws (CVE-2025-40809, CVE-2025-40810) and two out-of-bounds read flaws (CVE-2025-40811, CVE-2025-40812) allow local attackers to crash the application or execute arbitrary code in the context of the current process. All four vulnerabilities carry a CVSS v3.1 base score of 7.8, with lower CVSS v4 scores of 7.3 due to requiring user interaction (file opening) and local access. The vulnerabilities are triggered by specially crafted PRT files and do not require authentication or remote network access. No public exploitation has been reported as of the advisory date. Mitigation requires updating to patched versions or avoiding the opening of untrusted PRT files.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40809, CVE-2025-40810, CVE-2025-40811, CVE-2025-40812

## Detection guidance (public sample)

### Solid Edge Spawning Shell or Script Interpreter

ATT&CK: T1204.002

Solid Edge (Edge.exe) spawning a command shell, script host or LOLBin, as expected after a crafted PRT file triggers code execution in the application process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Solid Edge Spawning Shell or Script Interpreter
description: Detects the Siemens Solid Edge main process (Edge.exe) launching command
  interpreters, script hosts or common download/proxy-execution LOLBins. CAD software
  has little legitimate need to do this, so it is a strong post-exploitation signal
  for memory-corruption bugs in PRT parsing (CVE-2025-40809 to CVE-2025-40812).
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: Solid Edge
    ParentImage|endswith: \Edge.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
    - \msiexec.exe
  condition: selection_parent and selection_child
falsepositives:
- Solid Edge add-ins or installers that shell out to cmd.exe or msiexec.exe during
  updates
- Custom automation macros run by CAD administrators
level: high
id: 59fea44e-1a49-5725-b109-dcd7f8964bd4
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-05
```

### Solid Edge Dropping Executable or Script Content in User-Writable Paths

ATT&CK: T1204.002

Solid Edge process writing executables, DLLs or scripts to temp, public or ProgramData locations, consistent with shellcode or payload staging after exploiting a malicious PRT file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Solid Edge Dropping Executable or Script Content in User-Writable Paths
description: Detects the Solid Edge main process (Edge.exe) creating executable or
  script files in user-writable staging directories. Exploitation of PRT parsing flaws
  could be followed by payload staging from the compromised process.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_proc:
    Image|contains: Solid Edge
    Image|endswith: \Edge.exe
  selection_file:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .bat
    - .vbs
    - .js
    - .hta
    - .scr
  selection_path:
    TargetFilename|contains:
    - \AppData\Local\Temp\
    - \Users\Public\
    - \ProgramData\
    - \AppData\Roaming\
  condition: selection_proc and selection_file and selection_path
falsepositives:
- Solid Edge installers or add-in updaters extracting helper DLLs into temp folders
- Third-party CAD plugins that unpack components at first run
level: medium
id: dad13070-1fca-5cc3-9bb7-3e104a495eb9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-05
```

### Solid Edge Opening PRT File From Download or Email Cache Location

ATT&CK: T1204.002

Solid Edge launched with a .prt file from a download, temp or email attachment cache path, indicating a user opening an untrusted part file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Solid Edge Opening PRT File From Download or Email Cache Location
description: Detects Solid Edge being started with a PRT file located in browser download,
  temp or email attachment cache folders. Opening untrusted PRT files is the user-interaction
  step required to trigger CVE-2025-40809 to CVE-2025-40812. Useful as a hunting or
  context rule alongside child-process detections.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|contains: Solid Edge
    Image|endswith: \Edge.exe
  selection_cmd:
    CommandLine|contains: .prt
  selection_path:
    CommandLine|contains:
    - \Downloads\
    - \AppData\Local\Temp\
    - \Content.Outlook\
    - \INetCache\
  condition: selection_proc and selection_cmd and selection_path
falsepositives:
- Engineers legitimately opening part files received from suppliers or customers via
  email or browser download
- Users opening PRT files extracted to temp by archive tools
level: low
id: 29fd65d7-73c4-56ba-82c8-752ef8561827
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-05
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-289-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e6bb4f05-cec8-5a44-bc81-edcd34d849a2/siemens-solid-edge-prt-parsing-flaws-allow-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup