Siemens Tecnomatix Plant Simulation prior 2302.0018/2404.0007 WRL File out-of-bounds write

Summaryinfo

A vulnerability categorized as critical has been discovered in Siemens Tecnomatix Plant Simulation. This affects an unknown part of the component WRL File Handler. Executing a manipulation can lead to out-of-bounds write. The identification of this vulnerability is CVE-2024-52573. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Siemens Tecnomatix Plant Simulation and classified as critical. This vulnerability affects an unknown functionality of the component WRL File Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0018), Tecnomatix Plant Simulation V2404 (All versions < V2404.0007). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-24521)

The advisory is available at cert-portal.siemens.com. This vulnerability was named CVE-2024-52573 since 11/14/2024. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 12/11/2024).

Upgrading to version 2302.0018 or 2404.0007 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• SCADA Software

Vendor

• Siemens

Name

• Tecnomatix Plant Simulation

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion