PT-2025-6196 · Mentor Graphics · Questa+1

Ycdxsb · Published 2025-02-11 · Updated 2025-02-11 · CVE-2024-53977

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ModelSim versions prior to V2025.1 Questa versions prior to V2025.1

Description: A vulnerability has been identified that allows an authenticated local attacker to inject arbitrary code and escalate privileges. This is possible because an example setup script contained in affected applications loads a specific executable file from the current working directory. If administrators or processes with elevated privileges launch the script from a user-writable directory, the attacker could exploit this issue.

Recommendations: For ModelSim versions prior to V2025.1, update to version V2025.1 or later to resolve the issue. For Questa versions prior to V2025.1, update to version V2025.1 or later to resolve the issue. As a temporary workaround, consider restricting the launch of the setup script from user-writable directories to minimize the risk of exploitation.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2024-53977

Affected Products

Modelsim

Questa

References · 7

• https://osv.dev/vulnerability/CVE-2024-53977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53977 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-637914.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1889265760461357436 · Twitter Post
• https://t.me/cvedetector/17700 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1889348010808668163 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1889278569450197433 · Twitter Post