CVE-2021-27398

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow, a different vulnerability than CVE-2021-27396. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13290)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Siemens	Tecnomatix Plant Simulation	All versions < V16.0.5

References

https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdfVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-570/Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdfVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-570/Third Party Advisory, VDB Entry

Timeline

Published: May 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-273997.8A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.M CVE-2021-274007.5HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certif CVE-2021-274016.1The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing CVE-2021-274026.5The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injec CVE-2021-274036.1Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.CVE-2021-274046.1Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header.CVE-2021-274057.5A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js.CVE-2021-274068.8An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running o CVE-2021-274087.5The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chai CVE-2021-274109.8The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn me CVE-2021-274116.5Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolC CVE-2021-274127.8Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbit