✕
Request a Demo
Rewterz
Rewterz Threat Advisory – CVE-2023-25761 – Jenkins JUnit Plugin Vulnerability
February 16, 2023
Rewterz
Rewterz Threat Advisory – ICS: Siemens COMOS Vulnerability
February 16, 2023

Rewterz Threat Advisory – ICS: Multiple Siemens Tecnomatix Plant Simulation Vulnerabilities

Severity

High

Analysis Summary

CVE-2023-24978 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an uninitialized pointer access. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24979 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24980 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24981 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24982 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24983 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24984 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24985 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24986 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24987 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24988 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24989 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24990 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24991 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24992 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24993 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24994 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24995 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

CVE-2023-24996 CVSS:7.8

Siemens Tecnomatix Plant Simulation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write. By persuading a victim to open a specially-crafted SPP file, an attacker could exploit this vulnerability to execute arbitrary code in the context of the current process.

Impact

  • Code Execution

Indicators Of Compromise

CVE

  • CVE-2023-24978
  • CVE-2023-24979
  • CVE-2023-24980
  • CVE-2023-24981
  • CVE-2023-24982
  • CVE-2023-24983
  • CVE-2023-24984
  • CVE-2023-24985
  • CVE-2023-24986
  • CVE-2023-24987
  • CVE-2023-24988
  • CVE-2023-24989
  • CVE-2023-24990
  • CVE-2023-24991
  • CVE-2023-24992
  • CVE-2023-24993
  • CVE-2023-24994
  • CVE-2023-24995
  • CVE-2023-24996

Affected Vendors

Siemens

Affected Products

  • Siemens Tecnomatix Plant Simulation 15.0
  • Siemens Tecnomatix Plant Simulation 15.2
  • Siemens Tecnomatix Plant Simulation 16.0
  • Siemens Tecnomatix Plant Simulation 16.1
  • Siemens Tecnomatix Plant Simulation 2201

Remediation

Refer to Siemens Security Advisory for patch, upgrade or suggested workaround information.

Siemens Security Advisory