CVE-2024-23800

2024-02-1309:15:48

CWE-476

siemens

web.nvd.nist.gov

cve

tecnomatix plant simulation

vulnerability

denial of service

spp files

nvd

cve-2024-23800

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

Percentile

12.7%

JSON

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.

Affected configurations

Nvd

Node

siemenstecnomatix_plant_simulationRange2302.0–2302.0007

siemenstecnomatix_plant_simulationMatch2201.0-

VendorProductVersionCPE
siemenstecnomatix_plant_simulation*cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:*
siemenstecnomatix_plant_simulation2201.0cpe:2.3:a:siemens:tecnomatix_plant_simulation:2201.0:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	tecnomatix_plant_simulation	*	cpe:2.3:a:siemens:tecnomatix_plant_simulation::::::::
siemens	tecnomatix_plant_simulation	2201.0	cpe:2.3:a:siemens:tecnomatix_plant_simulation:2201.0:-::::::

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "Tecnomatix Plant Simulation V2201",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Tecnomatix Plant Simulation V2302",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V2302.0007",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]