The vulnerabilities are out-of-bounds write, heap-based buffer overflow, stack-based buffer overflow, NULL pointer dereference, and out-of-bounds read.
Successful exploitation of this vulnerability, which Siemens self-reported, could allow an attacker to crash the application or execute arbitrary code if a user is tricked into opening a malicious file.
The following Siemens products suffer from the issue:
- Tecnomatix Plant Simulation V2201: Versions prior to V2201.0012 (CVE-2024-23795, CVE-2024-23796, CVE-2024-23797, CVE-2024-23798, CVE-2024-23802, CVE-2024-23804)
- Tecnomatix Plant Simulation V2201: All versions (CVE-2024-23799, CVE-2024-23800, CVE-2024-23801, CVE-2024-23803)
- Tecnomatix Plant Simulation V2302: Versions prior to V2302.0006 (CVE-2024-23795, CVE-2024-23796, CVE-2024-23797, CVE-2024-23798, CVE-2024-23802, CVE-2024-23804)
- Tecnomatix Plant Simulation V2302: Versions prior to V2302.0007 (CVE-2024-23799, CVE-2024-23800, CVE-2024-23801, CVE-2024-23803)
In one vulnerability, the affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process.
CVE-2024-23795 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8. A CVSS v4 score has also been calculated with a base score of 7.3.
In addition, the affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-23796 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8. A CVSS v4 score has also been calculated with a base score of 7.3.
Also, the affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-23797 is the case number for this vulnerability, which has as CVSS v3 base score of 7.8. A CVSS v4 score has also been calculated with a base score of 7.3.
Meanwhile, the affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-23798 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8. A CVSS v4 score has also been calculated with a base score of 7.3.
In another issue, the affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVE-2024-23799 is the case number for this vulnerability, which has a CVSS v3 base score of 3.3. A CVSS v4 score has also been calculated with a base score of 4.8.
In addition, the affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVE-2024-23800 is the case number for this vulnerability, which has a CVSS v3 base score of 3.3. A CVSS v4 score has also been calculated with a base score of 4.8.
Also, the affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVE-2024-23801 is the case number for this vulnerability, which has a CVSS v3 base score of 3.3. A CVSS v4 score has also been calculated with a base score of 4.8.
Meanwhile, the affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-23802 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8. A CVSS v4 score has also been calculated with a base score of 7.3.
In another issue, the affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
CVE-2024-23803 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8. A CVSS v4 score has also been calculated with a base score of 7.3.
In addition, the affected applications contain a stack overflow vulnerability while parsing specially crafted PSOBJ files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-23804 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8. A CVSS v4 score has also been calculated with a base score of 7.3.
The product sees use mainly in the critical manufacturing sector, and on a global basis.
No known public exploits target these vulnerabilities. These vulnerabilities are not exploitable remotely. However, an attacker could leverage these low complexity vulnerabilities.
Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:
- Tecnomatix Plant Simulation V2201 (CVE-2024-23795, CVE-2024-23796, CVE-2024-23797, CVE-2024-23798, CVE-2024-23802, CVE-2024-23804): Update to V2201.0012 or later versionÂ
- Tecnomatix Plant Simulation V2201 (CVE-2024-23799, CVE-2024-23800, CVE-2024-23801, CVE-2024-23803): Currently not planning on a fix
- Tecnomatix Plant Simulation V2302 (CVE-2024-23795, CVE-2024-23796, CVE-2024-23797, CVE-2024-23798, CVE-2024-23802, CVE-2024-23804): Update to V2302.0006 or later versionÂ
- Tecnomatix Plant Simulation V2302 (CVE-2024-23799, CVE-2024-23800, CVE-2024-23801, CVE-2024-23803): Update to V2302.0007 or later versionÂ
Siemens also recommends users do not open untrusted WRL, PSOBJ, or SPP files from using Tecnomatix Plant Simulation.
As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.
For more information see the associated Siemens security advisory SSA-017796.