CVE-2024-23801: 
Siemens Tecnomatix Plant Simulation vulnerability analysis and mitigation

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions) and Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. The vulnerability was discovered and disclosed on February 13, 2024, and was assigned CVE-2024-23801 (Siemens Advisory).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) that occurs during the parsing of SPP files. It has been assigned a CVSS v3.1 Base Score of 3.3 (LOW) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L and a CVSS v4.0 Base Score of 4.8 with vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (CISA Advisory, Siemens Advisory).

An attacker could leverage this vulnerability to crash the application causing denial of service condition. The vulnerability requires local access and user interaction to exploit (Siemens Advisory).

For Tecnomatix Plant Simulation V2302, users should update to V2302.0007 or later version. For Tecnomatix Plant Simulation V2201, no fix is currently planned. As a general mitigation, Siemens recommends not opening untrusted SPP files using Tecnomatix Plant Simulation (Siemens Advisory).