Read the docs
TI-2023-24404 Aliases CVE-2023-45601GHSA-r7vr-7m7q-pqv6

Stack-based buffer overflow in Siemens Parasolid V35.0

Priority LOW 36CWE-121Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.262), Parasolid V35.1 (All versions < V35.1.250), Parasolid V36.0 (All versions < V36.0.169), Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain a stack overflow vulnerability while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21290)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed Parasolid V35.0 (Siemens): V35.0.262Parasolid V35.1 (Siemens): V35.1.250+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensParasolid V35.0before V35.0.262V35.0.262Patch availableCNA
SiemensParasolid V35.1before V35.1.250V35.1.250Patch availableCNA
SiemensParasolid V36.0before V36.0.169V36.0.169Patch availableCNA
SiemensTecnomatix Plant Simulation V2201before V2201.0009V2201.0009Patch availableCNA
SiemensTecnomatix Plant Simulation V2302before V2302.0003V2302.0003Patch availableCNA
  • Parasolid V35.0 VendorSiemens Affected before V35.0.262 Fixed in V35.0.262 Patch available CNA
  • Parasolid V35.1 VendorSiemens Affected before V35.1.250 Fixed in V35.1.250 Patch available CNA
  • Parasolid V36.0 VendorSiemens Affected before V36.0.169 Fixed in V36.0.169 Patch available CNA
  • Tecnomatix Plant Simulation V2201 VendorSiemens Affected before V2201.0009 Fixed in V2201.0009 Patch available CNA
  • Tecnomatix Plant Simulation V2302 VendorSiemens Affected before V2302.0003 Fixed in V2302.0003 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*35.0 to before 35.0.262; 35.1 to before 35.1.250; 36.0 to before 36.0.169VulnerableSiemens
cpe:2.3:a:siemens:tecnomatix:*:*:*:*:*:*:*:*2201 to before 2201.0009; 2302 to before 2302.0003VulnerableSiemens
  • cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:* Versions 35.0 to before 35.0.262; 35.1 to before 35.1.250; 36.0 to before 36.0.169 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:tecnomatix:*:*:*:*:*:*:*:* Versions 2201 to before 2201.0009; 2302 to before 2302.0003 Vulnerable ·Siemens

Remediation

  • Fix · CNA Parasolid V35.0 (Siemens) Fixed in V35.0.262
  • Fix · CNA Parasolid V35.1 (Siemens) Fixed in V35.1.250
  • Fix · CNA Parasolid V36.0 (Siemens) Fixed in V36.0.169
  • Fix · CNA Tecnomatix Plant Simulation V2201 (Siemens) Fixed in V2201.0009
  • Fix · CNA Tecnomatix Plant Simulation V2302 (Siemens) Fixed in V2302.0003

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45601
  2. 2026-10-03 Alias added: GHSA-r7vr-7m7q-pqv6

References

Patch 1

  • TI-2022-22893 Out-of-bounds read in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
  • TI-2022-22891 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
  • TI-2024-21079 Out-of-bounds write in Siemens Parasolid V35.1 CVSS 3.1HIGH 7.8
  • TI-2023-21659 Out-of-bounds write in Siemens Parasolid V34.1 CVSS 3.1HIGH 7.8
  • TI-2022-22892 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
  • TI-2022-22889 Out-of-bounds write in Siemens Parasolid V33.1 CVSS 3.1HIGH 7.8
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences