Siemens Solid Edge SE2025 < V225.0 Update 15 / SE2026 < V226.0 Update 7 Multiple Vulnerabilities (SSA-621657)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335343);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id(
    "CVE-2026-50058",
    "CVE-2026-50059",
    "CVE-2026-50060",
    "CVE-2026-50061",
    "CVE-2026-50062",
    "CVE-2026-50063",
    "CVE-2026-50064"
  );
  script_xref(name:"IAVA", value:"2026-A-0827");

  script_name(english:"Siemens Solid Edge SE2025 < V225.0 Update 15 / SE2026 < V226.0 Update 7 Multiple Vulnerabilities (SSA-621657)");

  script_set_attribute(attribute:"synopsis", value:
"A CAD application installed on the remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Siemens Solid Edge installed on the remote Windows host is SE2025 prior to V225.0 Update 15, or SE2026
prior to V226.0 Update 7. It is, therefore, affected by multiple file parsing vulnerabilities:

  - The affected applications contains an out of bounds read vulnerability while parsing specially crafted DFT files.
    This could allow an attacker to execute code in the context of the current process. (CVE-2026-50058)

  - The affected applications contains an out of bounds write vulnerability while parsing specially crafted DFT files.
    This could allow an attacker to execute code in the context of the current process. (CVE-2026-50059)

  - The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially
    crafted DFT files. This could allow an attacker to execute code in the context of the current process.
    (CVE-2026-50060)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-621657.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Siemens Solid Edge SE2025 V225.0 Update 15 / SE2026 V226.0 Update 7 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50064");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:siemens:solid_edge");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("siemens_solid_edge_win_installed.nbin");
  script_require_keys("installed_sw/Solid Edge");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Solid Edge', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '225.0', 'fixed_version': '225.00.15', 'fixed_display': '225.00.15 (SE2025 Update 15)'},
        {'min_version': '226.0', 'fixed_version': '226.00.07', 'fixed_display': '226.00.07 (SE2026 Update 7)'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);