How severe is CVE-2021-22645?

CVE-2021-22645 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-22645 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (71st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-22645?

CVE-2021-22645 primarily affects Luxion Keyshot. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-22645?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2021-22645 published?

CVE-2021-22645 was published on 2021-02-23 and last updated on 2026-06-17.

CVE-2021-22645

CVE-2021-22645 is a high-severity vulnerability in Luxion Keyshot with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-357.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v2: 6.8
EPSS exploit prediction: 2% (71st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-357
Affected product: Luxion Keyshot
Published: 2021-02-23
Last modified: 2026-06-17

Description

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll from a remote network share. As a result, the .dll entry point can be executed without sufficient UI warning.

Frequently asked questions

What is CVE-2021-22645?: Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll from a remote network share. As a result, the .dll entry point can be executed without sufficient UI warning.
How severe is CVE-2021-22645?: CVE-2021-22645 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-22645 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-22645?: CVE-2021-22645 primarily affects Luxion Keyshot. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-22645?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2021-22645 published?: CVE-2021-22645 was published on 2021-02-23 and last updated on 2026-06-17.

References

Affected products (6)

cpe:2.3:a:luxion:keyshot:*:*:*:*:*:*:*:*
cpe:2.3:a:luxion:keyshot_network_rendering:*:*:*:*:*:*:*:*
cpe:2.3:a:luxion:keyshot_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:luxion:keyvr:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:solid_edge_se2020_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:solid_edge_se2021_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Luxion Keyshot

CVE-2025-7222 — High (CVSS 7.8): Luxion KeyShot 3DM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows…
CVE-2025-1047 — High (CVSS 7.8): Luxion KeyShot PVS File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability…
CVE-2025-1046 — High (CVSS 7.8): Luxion KeyShot SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote…
CVE-2025-1045 — High (CVSS 7.8): Luxion KeyShot Viewer KSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This…
CVE-2025-2532 — High (CVSS 7.8): Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote…
CVE-2025-2531 — High (CVSS 7.8): Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability…

All CVEs affecting Luxion Keyshot →

Other CWE-357 vulnerabilities

CVE-2025-33054 — High (CVSS 8.1): Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform…
CVE-2025-49587 — High (CVSS 8.0): XWiki is an open-source wiki software platform. When a user without script right creates a document with an…
CVE-2025-49585 — High (CVSS 8.0): XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through…
CVE-2025-49582 — High (CVSS 8.0): XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros…
CVE-2024-43505 — High (CVSS 7.8): Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2019-13521 — High (CVSS 7.8): A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software…

Browse all CWE-357 vulnerabilities →