CVE-2024-23802

At a glance

Severity: HIGH 7.8
EPSS: EPSS 0.21 % · percentile 11 (2026-10-27)
State: PUBLISHED
Published: 2024-02-13
Updated: 2025-05-09
Assigner: siemens
NVD status: Modified

Description

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · productcert@siemens.com (Secondary)

Weaknesses (CWE)

CWE-125

European references

ENISA EUVD · EUVD-2024-21255
GCVE · GCVE-0-2024-23802

CERT-FR advisories

CERTFR-2024-AVI-0119 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:* < 2201.0012
cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:* ≥ 2302.0 < 2302.0006

Affected products

Product	Versions
Siemens · Tecnomatix Plant Simulation V2201	affected 0 < V2201.0012
Siemens · Tecnomatix Plant Simulation V2302	affected 0 < V2302.0006

References

https://cert-portal.siemens.com/productcert/html/ssa-017796.html

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD