CVE-2024-23804 Overview
CVE-2024-23804 is a stack-based buffer overflow vulnerability in Siemens Tecnomatix Plant Simulation. The flaw exists in the PSOBJ file parser and affects Tecnomatix Plant Simulation V2201 before V2201.0012 and V2302 before V2302.0006. An attacker who convinces a user to open a crafted PSOBJ file can execute arbitrary code in the context of the current process. The issue is tracked under CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write).
Critical Impact
Successful exploitation results in local code execution with the privileges of the Tecnomatix Plant Simulation user, compromising confidentiality, integrity, and availability of engineering workstations used in industrial simulation.
Affected Products
- Siemens Tecnomatix Plant Simulation V2201, all versions prior to V2201.0012
- Siemens Tecnomatix Plant Simulation V2302, all versions prior to V2302.0006
- Engineering workstations processing PSOBJ object files
Discovery Timeline
- 2024-02-13 - CVE-2024-23804 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23804
Vulnerability Analysis
The vulnerability resides in the routine that parses PSOBJ files inside Tecnomatix Plant Simulation. PSOBJ files describe simulation objects and are loaded by engineers into the modeling environment. When the parser processes a specially crafted file, it writes attacker-controlled data past the bounds of a stack-allocated buffer.
The attack requires local access and user interaction. An engineer must open or import the malicious file, typically delivered via email, shared network drive, or supply-chain compromise of simulation assets. Once triggered, the overflow corrupts stack memory and can redirect execution to attacker-supplied code running in the user's security context.
Because simulation engineers often hold elevated access to operational technology (OT) planning environments, the impact extends beyond the individual workstation. Compromised hosts can pivot into shared model repositories or downstream manufacturing execution systems.
Root Cause
The root cause is missing bounds validation while copying structured fields from the PSOBJ file into a fixed-size stack buffer. Length values embedded in the file are trusted without verification, allowing an out-of-bounds write ([CWE-787]) that overwrites return addresses and saved registers on the stack ([CWE-121]).
Attack Vector
Exploitation requires the target user to open a crafted PSOBJ file inside the vulnerable application. Delivery vectors include phishing attachments, malicious project archives, or trojanized model libraries. No network exposure is required; the attack surface is entirely local file parsing. Refer to the Siemens Security Advisory SSA-017796 for parser-level technical detail.
No verified public exploit code is available for CVE-2024-23804.
See the Siemens ProductCERT advisory SSA-017796 for parser behavior.
Detection Methods for CVE-2024-23804
Indicators of Compromise
- Unexpected PSOBJ files arriving via email, removable media, or unmanaged file shares on engineering workstations
- Crash dumps or Windows Error Reporting entries referencing the Tecnomatix Plant Simulation process after opening a model file
- Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by the Plant Simulation executable
- Outbound network connections originating from the simulation process shortly after a file is opened
Detection Strategies
- Monitor process lineage on engineering hosts and alert when Tecnomatix Plant Simulation spawns interpreters, script hosts, or shell utilities.
- Enable Windows Defender Exploit Guard or equivalent to log stack corruption and control-flow violations in the simulation process.
- Inspect email gateways and file shares for .psobj attachments from external or untrusted sources.
Monitoring Recommendations
- Collect EDR telemetry from all workstations running Tecnomatix Plant Simulation and centralize it for behavioral analysis.
- Baseline normal file-open patterns for the application and alert on anomalous parent-child process trees.
- Track software inventory to identify hosts still running versions below V2201.0012 or V2302.0006.
How to Mitigate CVE-2024-23804
Immediate Actions Required
- Upgrade Tecnomatix Plant Simulation V2201 to V2201.0012 or later, and V2302 to V2302.0006 or later.
- Restrict opening of PSOBJ files to those originating from trusted, signed sources or internal repositories under access control.
- Educate engineering staff on the risk of opening simulation files received from external parties.
Patch Information
Siemens released fixed builds V2201.0012 and V2302.0006 that address the parser bounds check. Full remediation details are published in the Siemens Security Advisory SSA-017796. Apply the vendor updates through the standard Siemens software delivery channel.
Workarounds
- Do not open PSOBJ files from untrusted or unverified sources until patches are applied.
- Run Tecnomatix Plant Simulation under a standard user account rather than a privileged account to limit the impact of code execution.
- Isolate engineering workstations from general-purpose corporate networks and enforce application allowlisting on OT hosts.
# Verify installed Tecnomatix Plant Simulation version on Windows
reg query "HKLM\SOFTWARE\Siemens\Tecnomatix Plant Simulation" /s | findstr /i "Version"
# Block inbound PSOBJ attachments at the mail gateway (example rule syntax)
# attachment.extension == "psobj" AND sender.domain NOT IN trusted_partners
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
