Read the docs
TI-2024-15794 Aliases CVE-2024-23800GHSA-pq7f-896m-7jg7

NULL pointer dereference in Siemens Tecnomatix Plant Simulation V2201

Priority LOW 24CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-476.

Summary

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0017 6th percentileScored 2026-11-07
Fix Fixed Tecnomatix Plant Simulation V2302 (Siemens): V2302.0007

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensTecnomatix Plant Simulation V2201all versions—No fix listedCNA
SiemensTecnomatix Plant Simulation V2302before V2302.0007V2302.0007Patch availableCNA
  • Tecnomatix Plant Simulation V2201 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Tecnomatix Plant Simulation V2302 VendorSiemens Affected before V2302.0007 Fixed in V2302.0007 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:*2302.0 to before 2302.0007VulnerableSiemens
cpe:2.3:a:siemens:tecnomatix_plant_simulation:2201.0:-:*:*:*:*:*:*2201.0VulnerableSiemens
  • cpe:2.3:a:siemens:tecnomatix_plant_simulation:*:*:*:*:*:*:*:* Versions 2302.0 to before 2302.0007 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:tecnomatix_plant_simulation:2201.0:-:*:*:*:*:*:* Versions 2201.0 Vulnerable ·Siemens

Remediation

  • Fix · CNA Tecnomatix Plant Simulation V2302 (Siemens) Fixed in V2302.0007

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens Tecnomatix Plant Simulation V2302 V2302.0007

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2024-15797 Out-of-bounds write in Siemens Tecnomatix Plant Simulation V2201Priority LOW 35
    • TI-2024-15795 NULL pointer dereference in Siemens Tecnomatix Plant Simulation V2201Priority LOW 24
    • TI-2024-15793 NULL pointer dereference in Siemens Tecnomatix Plant Simulation V2201Priority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23800
  2. 2026-10-03 Alias added: GHSA-pq7f-896m-7jg7

References

Patch 1

  • TI-2023-12136 Stack-based buffer overflow in Siemens Tecnomatix Plant Simulation CVSS 3.1HIGH 7.8
  • TI-2021-08891 Stack-based buffer overflow in Siemens Tecnomatix Plant Simulation CVSS 3.1HIGH 7.8
  • TI-2021-08890 Memory corruption in Siemens Tecnomatix Plant Simulation CVSS 3.1HIGH 7.8
  • TI-2021-08889 Stack-based buffer overflow in Siemens Tecnomatix Plant Simulation CVSS 3.1HIGH 7.8
  • TI-2024-15792 Stack-based buffer overflow in Siemens Tecnomatix Plant Simulation V2201 CVSS 3.1HIGH 7.8
  • TI-2024-15791 Stack-based buffer overflow in Siemens Tecnomatix Plant Simulation V2201 CVSS 3.1HIGH 7.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences