Cyber Resilience

CVE-2021-27042

High

Published: 25 June 2021

Published
25 June 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0037 59.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-27042 is a high-severity Improper Handling of Exceptional Conditions (CWE-755) vulnerability in Autodesk Advance Steel. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 40.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. The vulnerability exists because the application fails to handle a crafted DWG file, which causes an unhandled exception. An attacker can leverage…

more

this vulnerability to execute arbitrary code.

CWE(s)
CWE-755

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

autodesk
advance steel
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
autocad
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
autocad architecture
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
autocad electrical
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
autocad lt
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
autocad map 3d
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
autocad mechanical
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
autocad mep
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
autocad plant 3d
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1
autodesk
civil 3d
2019 — 2019.1.3 · 2020 — 2020.1.4 · 2021 — 2021.1.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-5 Response to Audit Logging Process Failures
addresses: CWE-755

Provides defined handling (alert and additional actions) for the exceptional condition of audit logging failure.

CP-12 Safe Mode
addresses: CWE-755

Supplies a concrete handling action (safe mode) for exceptional conditions, mitigating risks from improper or absent handling that could allow continued attacks.

CP-3 Contingency Training
addresses: CWE-755

By preparing users for contingency scenarios, the control promotes proper handling of exceptional conditions instead of default or unsafe behaviors.

CP-5 Contingency Plan Update
addresses: CWE-755

An updated contingency plan defines current actions for exceptional conditions, reducing the window for attackers to exploit improper handling leading to system failure.

IR-1 Policy and Procedures
addresses: CWE-755

Procedures ensure proper handling of exceptional conditions to support effective incident response.

IR-3 Incident Response Testing
addresses: CWE-755

Incident response testing confirms proper handling of exceptional conditions to limit exploit impact.

IR-7 Incident Response Assistance
addresses: CWE-755

Gives users guidance on incident handling, reducing improper handling of exceptional conditions that could stem from exploited weaknesses.

SC-24 Fail in Known State
addresses: CWE-755

Enforces structured response to exceptional conditions so the system cannot remain in an unsafe state.

References