CVE-2025-23397

11.03.2025, 10:15

A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application is vulnerable to memory corruption while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
siemens	CNA	7.8 HIGH				CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 5%

Vendor	Product	Version
siemens	teamcenter_visualization	14.0.0 ≤ 𝑥 < 14.3.0.13
siemens	teamcenter_visualization	2312.0 ≤ 𝑥 < 2312.0009
siemens	teamcenter_visualization	2406.0 ≤ 𝑥 < 2406.0007
siemens	teamcenter_visualization	2412.0 ≤ 𝑥 < 2412.0002
siemens	tecnomatix_plant_simulation	2302.0 ≤ 𝑥 < 2302.0021
siemens	tecnomatix_plant_simulation	2404.0 ≤ 𝑥 < 2404.0010

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

https://cert-portal.siemens.com/productcert/html/ssa-050438.html