CVE-2024-23799: 
Siemens Tecnomatix Plant Simulation vulnerability analysis and mitigation

A null pointer dereference vulnerability (CVE-2024-23799) has been identified in Tecnomatix Plant Simulation V2201 (All versions) and Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The vulnerability exists while parsing specially crafted SPP files (Siemens Advisory, CISA Advisory).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) that occurs during the parsing of specially crafted SPP files. It has been assigned a CVSS v3.1 base score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, and a CVSS v4.0 score of 4.8 with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (CISA Advisory, Siemens Advisory).

An attacker could leverage this vulnerability to crash the application, causing a denial of service condition. The vulnerability requires local access and user interaction, as the target must open a malicious SPP file (Siemens Advisory).

For Tecnomatix Plant Simulation V2201, no fix is currently planned. For V2302, users should update to V2302.0007 or later version. Siemens recommends not opening untrusted SPP files using Tecnomatix Plant Simulation. As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' operational guidelines for Industrial Security (Siemens Advisory).