CVE-2023-38075

2023-09-1210:15:28

CWE-416

[email protected]

web.nvd.nist.gov

cve-2023-38075

vulnerability

code execution

jt2go

teamcenter visualization

tecnomatix plant simulation

use-after-free

wrl files

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

31.9%

JSON

A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1), Tecnomatix Plant Simulation V2201 (All versions < V2201.0010), Tecnomatix Plant Simulation V2302 (All versions < V2302.0004). The affected application contains a use-after-free vulnerability that could be triggered while parsing specially crafted WRL files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-20842)

Affected configurations

NVD

Node

siemensjt2goRange<14.3.0.1

siemensteamcenter_visualizationRange13.3.0–13.4.0.12

siemensteamcenter_visualizationRange14.0–14.1.0.11

siemensteamcenter_visualizationRange14.2–14.2.0.6

siemensteamcenter_visualizationRange14.3–14.3.0.1

siemenstecnomatix_plant_simulationRange2201.0–2201.0010

siemenstecnomatix_plant_simulationRange2302.0–2302.0004

CPENameOperatorVersion
siemens:jt2gosiemens jt2golt14.3.0.1
siemens:teamcenter_visualizationsiemens teamcenter visualizationlt13.4.0.12
siemens:teamcenter_visualizationsiemens teamcenter visualizationlt14.1.0.11
siemens:teamcenter_visualizationsiemens teamcenter visualizationlt14.2.0.6
siemens:teamcenter_visualizationsiemens teamcenter visualizationlt14.3.0.1
siemens:tecnomatix_plant_simulationsiemens tecnomatix plant simulationlt2201.0010
siemens:tecnomatix_plant_simulationsiemens tecnomatix plant simulationlt2302.0004

CPE	Name	Operator	Version
siemens:jt2go	siemens jt2go	lt	14.3.0.1
siemens:teamcenter_visualization	siemens teamcenter visualization	lt	13.4.0.12
siemens:teamcenter_visualization	siemens teamcenter visualization	lt	14.1.0.11
siemens:teamcenter_visualization	siemens teamcenter visualization	lt	14.2.0.6
siemens:teamcenter_visualization	siemens teamcenter visualization	lt	14.3.0.1
siemens:tecnomatix_plant_simulation	siemens tecnomatix plant simulation	lt	2201.0010
siemens:tecnomatix_plant_simulation	siemens tecnomatix plant simulation	lt	2302.0004

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "JT2Go",
    "versions": [
      {
        "version": "All versions < V14.3.0.1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Teamcenter Visualization V13.3",
    "versions": [
      {
        "version": "All versions < V13.3.0.12",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Teamcenter Visualization V14.0",
    "versions": [
      {
        "version": "All versions",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Teamcenter Visualization V14.1",
    "versions": [
      {
        "version": "All versions < V14.1.0.11",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Teamcenter Visualization V14.2",
    "versions": [
      {
        "version": "All versions < V14.2.0.6",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Teamcenter Visualization V14.3",
    "versions": [
      {
        "version": "All versions < V14.3.0.1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Tecnomatix Plant Simulation V2201",
    "versions": [
      {
        "version": "All versions < V2201.0010",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Tecnomatix Plant Simulation V2302",
    "versions": [
      {
        "version": "All versions < V2302.0004",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]