PT-2023-3247 · Siemens · Tecnomatix Plant Simulation

Published 2023-02-14 · Updated 2023-02-24 · CVE-2023-24978

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tecnomatix Plant Simulation versions prior to V2201.0006

Description The issue is related to access to an uninitialized pointer in the Tecnomatix Plant Simulation software. This can be exploited by an attacker using a specially crafted SPP file, allowing them to execute arbitrary code in the context of the current process.

Recommendations For versions prior to V2201.0006, update to version V2201.0006 or later to resolve the issue. As a temporary workaround, consider restricting access to SPP files or avoiding the use of specially crafted SPP files until the issue is resolved.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2023-03368

CVE-2023-24978

ZDI-23-186

Affected Products

Tecnomatix Plant Simulation

References · 6

• https://osv.dev/vulnerability/CVE-2023-24978 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24978 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-186 · Security Note
• https://bdu.fstec.ru/vul/2023-03368 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf · Vendor Advisory
• https://vuldb.com/ru/?id.220893 · Note