CVE-2023-24994
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability in Tecnomatix Plant Simulation (all versions < V2201.0006) involving an out-of-bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
Risk Assessment
May lead to arbitrary code execution when opening a malicious SPP file. High risk for application users.
Recommendation
Update Tecnomatix Plant Simulation to version V2201.0006 or later.
Other vulnerabilities in Tecnomatix Plant Simulation
See all- CVE-2023-37375High
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008) and V2302 (All versions < V2302.0002). The application is vulnerable to stack-based buffer overflow while parsing specially crafted SPP files.
- CVE-2023-37374High
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008) and V2302 (All versions < V2302.0002). The application is vulnerable to stack-based buffer overflow while parsing specially crafted STP files.
- CVE-2023-37246High
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008) and V2302 (All versions < V2302.0002). The application is vulnerable to heap-based buffer overflow while parsing specially crafted PRT files, which could allow an attacker to execute code in the context of the current process.
- CVE-2023-27406High
A vulnerability in Tecnomatix Plant Simulation (versions < V2201.0006) is vulnerable to a stack-based buffer overflow while parsing specially crafted SPP files. An attacker could leverage this to execute code in the context of the current process.
- CVE-2023-27405High
Tecnomatix Plant Simulation versions prior to V2201.0006 contain an out-of-bounds read past the end of an allocated structure when parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
- CVE-2023-27404High
Tecnomatix Plant Simulation (All versions < V2201.0006) is vulnerable to a stack-based buffer overflow while parsing specially crafted SPP files. An attacker could leverage this to execute code in the context of the current process.
- CVE-2023-27403High
Tecnomatix Plant Simulation versions prior to V2201.0006 contain a memory corruption vulnerability when parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
- CVE-2023-27402High
Tecnomatix Plant Simulation versions prior to V2201.0006 contain an out-of-bounds read past the end of an allocated structure when parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
- CVE-2023-27401High
A vulnerability in Tecnomatix Plant Simulation (versions < V2201.0006) contains an out-of-bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
- CVE-2023-27400High
A vulnerability in Tecnomatix Plant Simulation (versions < V2201.0006) contains an out-of-bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
Original NVD description (English source)
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19816)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

