CVE-2024-45470: 
Siemens Tecnomatix Plant Simulation vulnerability analysis and mitigation

A vulnerability (CVE-2024-45470) has been identified in multiple Siemens products including Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12), Teamcenter Visualization V2312 (All versions < V2312.0008), Tecnomatix Plant Simulation V2302 (All versions < V2302.0016), and Tecnomatix Plant Simulation V2404 (All versions < V2404.0005). The vulnerability was disclosed on October 8, 2024, with an update on December 10, 2024 (Siemens Advisory, CISA Advisory).

The vulnerability is classified as an out-of-bounds write vulnerability (CWE-787) that occurs when parsing specially crafted WRL files. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and a CVSS v4.0 base score of 7.3 with the vector string CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Siemens Advisory).

Successful exploitation of this vulnerability could allow an attacker to execute code in the context of the current process, potentially compromising the confidentiality, integrity, and availability of the affected systems (CISA Advisory).

Siemens has released updates to address this vulnerability and recommends users to update to the following versions: Teamcenter Visualization V14.2 to V14.2.0.14 or later, V14.3 to V14.3.0.12 or later, V2312 to V2312.0008 or later, Tecnomatix Plant Simulation V2302 to V2302.0016 or later, and V2404 to V2404.0005 or later. As a workaround, users are advised not to open untrusted WRL files in affected applications (Siemens Advisory).