Security readout for executives and security teams
Plain-English summary
A malicious drawing file can crash or take over a vulnerable VariCAD workstation if a user opens it. The risk is concentrated in legacy VariCAD EN deployments and file-exchange workflows. Public exploit references exist, but the provided sources do not show confirmed active exploitation.
Executive priority
Treat this as a targeted workstation risk for engineering or design environments. Prioritize asset discovery and removal of obsolete VariCAD EN versions, especially where staff exchange drawing files with customers, suppliers, or unknown senders.
Technical view
CVE-2010-20114 is a CWE-121 stack-based buffer overflow in VariCAD EN through 2010-2.05 when parsing .dwb files. The CVSS 4.0 score is 8.4, with local attack vector, low complexity, no privileges, and required user interaction. Successful exploitation may allow arbitrary code execution.
Likely exposure
Organizations are exposed if they still run VariCAD EN up to 2010-2.05 and users open .dwb files from external or untrusted sources. Exposure evidence is limited by inconsistent affected-product metadata in the source bundle.
Exploitation context
The source bundle includes public exploit references and network/security vendor signatures. However, KEV is false and no cited source in the bundle confirms active exploitation in the wild. The described attack depends on persuading a user to open a crafted .dwb file.
Researcher notes
The bundle reports VariCAD EN through 2010-2.05, but the affected array lists version "0" with defaultStatus "unaffected," which weakens precision. Public exploit references support exploitability, but no active exploitation evidence is provided. Avoid assuming a vendor patch unless confirmed from VariCAD guidance.
Mitigation direction
- Inventory VariCAD EN installations and confirm version numbers.
- Remove or upgrade VariCAD EN versions up to 2010-2.05 where found.
- Restrict opening .dwb files from untrusted external sources.
- Check VariCAD vendor guidance for fixed versions or supported upgrade paths.
- Use endpoint controls to contain legacy CAD workstations.
- Ensure email and web filtering treat .dwb files as risky attachments.
Validation and detection
- Confirm whether VariCAD EN is installed on engineering workstations.
- Review file association and usage logs for .dwb handling.
- Check whether users receive .dwb files from external parties.
- Verify security tools include relevant IPS or detection signatures.
- Document any compensating controls for legacy unsupported installations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2010-20114 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.4HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/varicad_dwb.rbCVE reference, VulnCheck · exploit
- https://www.exploit-db.com/exploits/11789CVE reference, VulnCheck · exploit
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=26522CVE reference, VulnCheck · third-party-advisory
- https://www.seebug.org/vuldb/ssvid-71154CVE reference, VulnCheck · third-party-advisory
- https://www.varicad.com/en/home/CVE reference, VulnCheck · product
- https://www.fortiguard.com/encyclopedia/ips/18735CVE reference, VulnCheck · third-party-advisory
- https://www.vulncheck.com/advisories/varicad-en-dwb-file-stack-buffer-overflowCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.