PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-54091 Siemens CVE debrief

CVE-2024-54091 is a high-severity memory-corruption issue in Siemens Solid Edge affecting SE2024 and SE2025. According to the CISA CSAF advisory and Siemens security advisory, the flaw is an out-of-bounds write past the end of an allocated buffer while parsing X_T data or a specially crafted X_T file. A successful attack could allow code execution in the context of the current process. Siemens published fixes for SE2024 and SE2025, and CISA lists the advisory as a local, user-interaction-requiring issue with high confidentiality, integrity, and availability impact.

Vendor
Siemens
Product
Solid Edge SE2024
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-10
Original CVE updated
2025-05-06
Advisory published
2024-12-10
Advisory updated
2025-05-06

Who should care

Organizations using Siemens Solid Edge SE2024 or SE2025, especially CAD/engineering teams, desktop administrators, and users who routinely import or open X_T files from outside trusted sources.

Technical summary

The advisory describes a parser memory-safety flaw triggered during X_T file handling. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access and user interaction are required, but no privileges are needed. The impact is code execution in the current process if a crafted file is processed. Siemens lists remediation for Solid Edge SE2024 and SE2025 via vendor updates, and CISA also recommends not opening untrusted X_T files or providing untrusted X_T data to affected applications.

Defensive priority

High. The issue is rated 7.8 High and can lead to code execution, but it requires user interaction with a crafted file and is not listed in CISA KEV in the supplied sources.

Recommended defensive actions

  • Update Siemens Solid Edge SE2024 to V224.0 Update 12 or later.
  • Update Siemens Solid Edge SE2025 to V225.0 Update 3 or later.
  • Do not open untrusted X_T files or feed untrusted X_T data into affected applications.
  • Apply CISA recommended ICS defensive practices for file handling, segmentation, and least-privilege workstation use.
  • Prioritize awareness for engineering users who exchange CAD files with external parties.

Evidence notes

This debrief is based on the supplied CISA CSAF source item for ICSA-25-100-03 and the linked Siemens advisory references. The source states the affected products are Solid Edge SE2024 and SE2025, the flaw is an out-of-bounds write during X_T parsing, and the remediation versions are V224.0 Update 12 and V225.0 Update 3 respectively. The advisory was published on 2025-04-08 and later revised on 2025-05-06 for typo fixes only. No KEV entry or active ransomware linkage is provided in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-54091 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-54091

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-54091 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-54091

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-100-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-672923.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-672923.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.