CVE-2024-52573

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All versions < V2406.0005), Tecnomatix Plant Simulation V2302 (All versions < V2302.0018), Tecnomatix Plant Simulation V2404 (All versions < V2404.0007). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-24521)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Siemens	Teamcenter Visualization V14.2	< V14.2.0.14
Siemens	Teamcenter Visualization V14.3	< V14.3.0.12
Siemens	Teamcenter Visualization V2312	< V2312.0008
Siemens	Teamcenter Visualization V2406	< V2406.0005
Siemens	Tecnomatix Plant Simulation V2302	< V2302.0018
Siemens	Tecnomatix Plant Simulation V2404	< V2404.0007
siemens	tecnomatix_plant_simulation	< 2302.0018; < 2404.0007
siemens	tecnomatix_plant_simulation	< 2302.0018; < 2404.0007

References

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-525747.8A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versi CVE-2024-525779.0In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vu CVE-2024-525795.4Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This CVE-2024-52584.3An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where a CVE-2024-525817.5Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with lites CVE-2024-525824.7Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isola CVE-2024-525838.2The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page CVE-2024-525845.4Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs CVE-2024-525855.4Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version CVE-2024-525867.8eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to v CVE-2024-525878.8StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of s CVE-2024-525887.5Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to t