CVE-2025-23399

CVE-2025-23399 is an out-of-bounds read vulnerability (CWE-125) identified in multiple versions of Siemens Teamcenter Visualization and Tecnomatix Plant Simulation. It affects Teamcenter Visualization V14.3 (all versions prior to V14.3.0.13), V2312 (all versions prior to V2312.0009), V2406 (all versions prior to V2406.0007), and V2412 (all versions prior to V2412.0002), as well as Tecnomatix Plant Simulation V2302 (all versions prior to V2302.0021) and V2404 (all versions prior to V2404.0010). The issue arises during parsing of specially crafted WRL files, potentially leading to code execution in the context of the current process. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-03-11.

Exploitation requires local access to the system (AV:L) with low attack complexity (AC:L), no privileges (PR:N), and user interaction (UI:R), such as convincing a user to open a malicious WRL file in one of the affected applications. No scope change occurs (S:U). Successful exploitation enables an attacker to achieve high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H) through arbitrary code execution in the process context.

The Siemens Security Advisory SSA-050438, available at https://cert-portal.siemens.com/productcert/html/ssa-050438.html, details mitigation steps, including upgrading to the patched versions specified for each affected product.