Executive Summary

Siemens CADRA drafting and design software bundles a vulnerable copy of the zlib compression library affected by CVE-2023-45853, an integer overflow in the MiniZip component that permits attacker controlled memory corruption during archive processing. The physical criticality is indirect but real: CADRA runs on engineering workstations that generate and store the mechanical design data feeding manufacturing lines, and a compromised design host is a pivot point into the broader OT engineering environment.

Technical Exposure Breakdown

CVE-2023-45853 lives in the zlib MiniZip module, specifically in the zipOpenNewFileInZip4_64 path where filename, extra field, and comment length values are combined without adequate bounds checking. On 32 bit builds the combined length can wrap, producing an integer overflow that leads to a heap buffer overflow when the crafted ZIP structure is written or parsed. The vulnerability carries a CVSS v3 base score of 9.8 because it is remotely reachable, requires no privileges, and needs no user interaction under the worst case network vector assumed by the scoring model.

The practical attack condition for CADRA is more constrained. Exploitation requires the target host to process a maliciously constructed compressed file. In an engineering context that means an attacker delivers a weaponized design archive, project bundle, or embedded document through email, a shared drive, or a removable device, then relies on CADRA or its associated Foxit PDF rendering component to parse the crafted content. The Foxit vulnerabilities disclosed alongside this issue add a second parsing surface: PDF documents opened inside the design workflow become a delivery mechanism for the same class of memory corruption.

The root problem is a software supply chain problem. MiniZip is embedded static library code, not a patchable operating system component. Every application that statically linked the affected zlib carries the flaw independently, which is why Siemens is issuing a rebuilt CADRA binary rather than pointing customers at an OS update. Any asset inventory built on OS level CVE matching will miss this exposure entirely.

OT Impact and Compliance Risk

CADRA does not run on a PLC, an RTU, or a safety instrumented system. It runs on the engineering side, and that is precisely where the OT and IT boundary gets blurry. A design workstation typically holds credentials, network reachability, and file exchange paths into production zones. Under IEC 62443 zone and conduit modeling, an engineering workstation in a Level 3 site operations zone that is compromised becomes a launch point toward Level 2 supervisory and Level 1 control assets. The workstation itself may not command a physical process, but it frequently has the routes and trust relationships that do.

For NERC CIP regulated entities, a CADRA host inside an Electronic Security Perimeter is subject to CIP-007 patch management and CIP-010 configuration baseline requirements. A statically linked library flaw complicates CIP-007 evidence, since the vulnerability will not appear in standard patch source feeds and must be tracked as vendor specific software. For TSA regulated pipeline and rail operators under SD-02C, this reinforces the requirement to segment and monitor engineering hosts rather than treating them as ordinary corporate endpoints.

Compensating Controls

Do not resolve this with active vulnerability scanning against the OT segment. Aggressive scanning of engineering hosts and adjacent controllers can crash fragile services and, in worst cases, brick industrial components. Passive discovery and vendor documented software version checks are the correct approach here.

BreachSpider tracks statically linked library exposures like CVE-2023-45853 across 175,000+ OT products so your team sees supply chain flaws that OS level scanners miss.