CVE-2024-45471: 
Siemens Tecnomatix Plant Simulation vulnerability analysis and mitigation

A critical out-of-bounds write vulnerability (CVE-2024-45471) has been identified in multiple versions of Siemens software products, including Teamcenter Visualization (V14.2, V14.3, V2312) and Tecnomatix Plant Simulation (V2302, V2404). The vulnerability was discovered in October 2024 and affects the WRL file parsing functionality in these applications (Siemens Advisory, ZDI Advisory).

The vulnerability is classified as an out-of-bounds write vulnerability (CWE-787) that occurs when parsing specially crafted WRL files. It has received a CVSS v3.1 base score of 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and a CVSS v4.0 base score of 7.3 with vector CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Siemens Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The vulnerability requires user interaction, specifically opening a malicious WRL file, to be exploited (ZDI Advisory).

Siemens has released security updates for all affected products: Teamcenter Visualization V14.2 (update to V14.2.0.14), V14.3 (update to V14.3.0.12), V2312 (update to V2312.0008), and Tecnomatix Plant Simulation V2302 (update to V2302.0016) and V2404 (update to V2404.0005). As a workaround, users are advised not to open untrusted WRL files in affected applications (Siemens Advisory).