CVE-2025-23402
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-23402 is a use-after-free vulnerability (CWE-416) affecting multiple versions of Siemens Teamcenter Visualization and Tecnomatix Plant Simulation. Specifically, it impacts Teamcenter Visualization V14.3 (all versions prior to V14.3.0.13), V2312 (prior to V2312.0009), V2406 (prior to V2406.0007), and V2412 (prior to V2412.0002); as well as Tecnomatix Plant Simulation V2302 (prior to V2302.0021) and V2404 (prior to V2404.0010). The flaw is triggered when the affected applications parse specially crafted WRL files, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Published on March 11, 2025, it enables arbitrary code execution in the context of the current process.
An attacker with local access to a system running a vulnerable version can exploit this issue by convincing a user to open a maliciously crafted WRL file through the application, as it requires user interaction but no privileges. Low attack complexity allows exploitation with minimal effort, potentially leading to high-impact confidentiality, integrity, and availability violations within the process scope, such as data theft, modification, or denial of service.
Siemens security advisory SSA-050438, available at https://cert-portal.siemens.com/productcert/html/ssa-050438.html, provides details on the vulnerability and mitigation steps, including upgrading to the specified patched versions or later.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The use-after-free vulnerability enables arbitrary code execution when parsing a malicious WRL file, directly mapping to T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution) as the user must open the crafted file.