Privilege Escalation Vulnerability in Simcenter STAR-CCM+
Plan Patch7.8SSA-930100Dec 13, 2022
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Simcenter STAR-CCM+ contains a privilege escalation vulnerability where a local attacker with an unprivileged account can override or modify the service executable to gain elevated privileges. Vulnerability allows unauthorized privilege escalation through insecure service configuration.
What this means
What could happen
A user with limited access to a Simcenter STAR-CCM+ workstation could gain full administrative control over the system, potentially allowing unauthorized modifications to simulation models, process data, or access to sensitive engineering files and configurations.
Who's at risk
Engineering and simulation teams using Simcenter STAR-CCM+ on Windows workstations or shared engineering servers should care. This affects anyone with local system access who could escalate privileges to modify simulation models, access intellectual property, or disrupt simulation workflows.
How it could be exploited
An attacker with a local unprivileged account on a machine running Simcenter STAR-CCM+ can modify the service executable file due to improper file permissions. When the service runs with elevated privileges, the attacker's modified executable executes with admin rights, granting full system control.
Prerequisites
- Local access to the machine running Simcenter STAR-CCM+
- Unprivileged user account on the system
- Simcenter STAR-CCM+ service installed and running
Privilege escalationLow complexity exploitationLocal access requiredAffects shared engineering systems
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
Simcenter STAR-CCM+< V23062306
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate Simcenter STAR-CCM+ to version V2306 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/1e23e3ba-f530-4eb5-b74e-da3826c89ce3