CVE-2024-52574

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions < V14.2.0.14), Teamcenter Visualization V14.3 (All versions < V14.3.0.12), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All versions < V2406.0005), Tecnomatix Plant Simulation V2302 (All versions < V2302.0018), Tecnomatix Plant Simulation V2404 (All versions < V2404.0007). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-24543)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Siemens	Teamcenter Visualization V14.2	< V14.2.0.14
Siemens	Teamcenter Visualization V14.3	< V14.3.0.12
Siemens	Teamcenter Visualization V2312	< V2312.0008
Siemens	Teamcenter Visualization V2406	< V2406.0005
Siemens	Tecnomatix Plant Simulation V2302	< V2302.0018
Siemens	Tecnomatix Plant Simulation V2404	< V2404.0007
siemens	tecnomatix_plant_simulation	< 2302.0018; < 2404.0007
siemens	tecnomatix_plant_simulation	< 2302.0018; < 2404.0007

References

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-525779.0In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vu CVE-2024-525795.4Misskey is an open source, federated social media platform. Some APIs using `HttpRequestService` do not properly check the target host. This CVE-2024-52584.3An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where a CVE-2024-525817.5Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with lites CVE-2024-525824.7Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isola CVE-2024-525838.2The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page CVE-2024-525845.4Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs CVE-2024-525855.4Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version CVE-2024-525867.8eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to v CVE-2024-525878.8StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of s CVE-2024-525887.5Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to t CVE-2024-525892.7Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and throu