MODEL File Parsing Vulnerability in Tecnomatix Plant Simulation before V2302.0012 and V2024.0001
Plan Patch7.8SSA-900277Jun 11, 2024
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Tecnomatix Plant Simulation contains a type confusion vulnerability in MODEL file parsing. When a user opens a malicious MODEL file, the application may crash or execute arbitrary code on the host system. The vulnerability is triggered during file read operations when the application encounters malformed data that causes type confusion in memory handling.
What this means
What could happen
If an engineer opens a malicious MODEL file in Tecnomatix Plant Simulation, the application could crash or an attacker could execute arbitrary code on the workstation, potentially compromising access to plant simulation environments and sensitive process designs.
Who's at risk
Manufacturing and automotive engineers using Siemens Tecnomatix Plant Simulation for production line design, process simulation, and layout planning should update immediately. This affects any organization using these tools to design or verify plant layouts and manufacturing workflows.
How it could be exploited
An attacker crafts a malicious MODEL file and tricks an engineer into opening it using Tecnomatix Plant Simulation. The file parsing vulnerability causes a type confusion error that either crashes the application or allows the attacker to run code on the engineer's workstation with the privileges of the user running the application.
Prerequisites
- User interaction required (engineer must open the malicious MODEL file)
- Access to send or host the malicious file where an engineer can retrieve it
Low attack complexityUser interaction requiredArbitrary code execution possibleAffects engineering workstations
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Tecnomatix Plant Simulation V2302<V2302.00122302.0012
Tecnomatix Plant Simulation V2404<V2404.00012404.0001
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Tecnomatix Plant Simulation V2302
HOTFIXUpdate Tecnomatix Plant Simulation V2302 to version 2302.0012 or later
Tecnomatix Plant Simulation V2404
HOTFIXUpdate Tecnomatix Plant Simulation V2404 to version 2404.0001 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/db48f790-7fa5-4dea-80b4-2922327a4999