OTPulse
FeedAboutContact

Multiple WRL File Parsing Vulnerabilities in Teamcenter Visualization

Plan Patch7.8SSA-645131Dec 10, 2024
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Siemens Teamcenter Visualization contains multiple file parsing vulnerabilities in WRL file handling. These vulnerabilities can be triggered when a user opens a malicious WRL file, leading to application crash or arbitrary code execution. The vulnerabilities affect buffer overflow and memory safety conditions (CWE-125, CWE-119, CWE-787, CWE-476, CWE-416, CWE-121).

What this means
What could happen
An attacker could trick a user into opening a malicious WRL file that crashes Teamcenter Visualization or executes arbitrary code with that user's privileges, potentially compromising engineering data or design systems used in plant operations.
Who's at risk
Engineering and design staff using Siemens Teamcenter Visualization for CAD/3D model review and collaborative design. This affects manufacturing, utilities, and infrastructure sectors where design engineering teams rely on Teamcenter for plant design, equipment modeling, and process documentation.
How it could be exploited
An attacker crafts a malicious WRL (VRML) file and sends it to an engineer or designer. When the user opens the file with vulnerable Teamcenter Visualization, the parser processes the crafted content and either crashes the application or executes arbitrary code with the user's account privileges.
Prerequisites
  • User must open a malicious WRL file using Teamcenter Visualization
  • Affected versions of Teamcenter Visualization must be installed
Requires user interaction (file opening)Low exploit complexityLow EPSS score (0.2%)Affects engineering workstations with access to design dataCould compromise design integrity or engineering systems
Exploitability
Low exploit probability (EPSS 0.2%)
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
Teamcenter Visualization V14.2< V14.2.0.1414.2.0.14
Teamcenter Visualization V14.3< V14.3.0.1214.3.0.12
Teamcenter Visualization V2312< V2312.00082312.0008
Teamcenter Visualization V2406< V2406.00052406.0005
Remediation & Mitigation
0/5
Do now
0/1
HARDENINGEducate users not to open WRL files from untrusted sources
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

Teamcenter Visualization V14.2
HOTFIXUpdate Teamcenter Visualization V14.2 to version 14.2.0.14 or later
Teamcenter Visualization V14.3
HOTFIXUpdate Teamcenter Visualization V14.3 to version 14.3.0.12 or later
Teamcenter Visualization V2312
HOTFIXUpdate Teamcenter Visualization V2312 to version 2312.0008 or later
Teamcenter Visualization V2406
HOTFIXUpdate Teamcenter Visualization V2406 to version 2406.0005 or later
View full Siemens ProductCERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/29e1152b-3cfc-49bd-85f0-a003f41427f0
Multiple WRL File Parsing Vulnerabilities in Teamcenter Visualization | CVSS 7.8 - OTPulse