CVE-2024-32639: 
Siemens Tecnomatix Plant Simulation vulnerability analysis and mitigation

A vulnerability (CVE-2024-32639) has been identified in Siemens Tecnomatix Plant Simulation V2302 (All versions < V2302.0011). The vulnerability was discovered and disclosed on May 14, 2024, affecting the MODEL file parsing functionality of the software (Siemens Advisory, ZDI Advisory).

The vulnerability is classified as an out-of-bounds write (CWE-787) that occurs when parsing specially crafted MODEL files. The issue stems from improper validation of user-supplied data, which can result in a write operation past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Siemens Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The attack could potentially lead to a system crash and compromise the affected system's confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability requires user interaction to exploit, as the target must open a malicious MODEL file. The attack vector is local (AV:L), with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R) (Siemens Advisory).

Siemens has released version V2302.0011 to address this vulnerability. Users are strongly recommended to update to this version or later. As a workaround, users should not open untrusted MODEL files from unknown sources. Siemens also recommends protecting network access to devices with appropriate mechanisms and following their operational guidelines for Industrial Security (Siemens Advisory).

The vulnerability was discovered and reported through the Zero Day Initiative (ZDI) program, identified as ZDI-CAN-22974. The coordinated disclosure was handled between ZDI and Siemens, with the public release occurring on June 10, 2024 (ZDI Advisory).