CVE-2023-24978

HIGH

Tecnomatix Plant Simulation <V2201.0006 - Code Injection

Title source: llm

Description

A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted SPP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19788)

References (1)

[Vendor Advisory] https://cert-portal.siemens.com/productcert/pdf/ssa-847261.pdf

Scores

CVSS v3 7.8

EPSS 0.0006

EPSS Percentile 18.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-824

Status published

Products (1)

siemens/tecnomatix_plant_simulation < 2201.0006

Published Feb 14, 2023

Tracked Since Feb 18, 2026