CVE-2024-23799

2024-02-1309:15:48

CWE-476

siemens

web.nvd.nist.gov

cve-2024-23799

tecnomatix

plant simulation

v2201

v2302

null pointer dereference

spp files

denial of service

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

Percentile

12.7%

JSON

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.

Affected configurations

Nvd

Node

siemenstecnomatix_plant_simulationRange2302.0–2302.0007

siemenstecnomatix_plant_simulationMatch2201.0-

VendorProductVersionCPE
siemenstecnomatix_plant_simulation*cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:*
siemenstecnomatix_plant_simulation2201.0cpe:2.3:a:siemens:tecnomatix_plant_simulation:2201.0:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	tecnomatix_plant_simulation	*	cpe:2.3:a:siemens:tecnomatix_plant_simulation::::::::
siemens	tecnomatix_plant_simulation	2201.0	cpe:2.3:a:siemens:tecnomatix_plant_simulation:2201.0:-::::::

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "Tecnomatix Plant Simulation V2201",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Tecnomatix Plant Simulation V2302",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V2302.0007",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]