C V E - 2 0 2 4 - 4 5 4 6 4 : S i e m e n s T e c n o m a t i x P l a n t S i m u l a t i o n R C E V u l n e r a b i l i t y

C V E - 2 0 2 4 - 4 5 4 6 4 i s a r e m o t e c o d e e x e c u t i o n v u l n e r a b i l i t y i n S i e m e n s T e c n o m a t i x P l a n t S i m u l a t i o n c a u s e d b y a n o u t o f b o u n d s r e a d w h e n p a r s i n g W R L f i l e s . T h i s p o s t c o v e r s t e c h n i c a l d e t a i l s , a f f e c t e d v e r s i o n s , i m p a c t , a n d m i t i g a t i o n s t e p s .

CVE-2024-45464 Overview

CVE-2024-45464 is an out-of-bounds read vulnerability affecting Siemens Teamcenter Visualization and Tecnomatix Plant Simulation. The flaw resides in the WRL (Virtual Reality Modeling Language) file parser. When the application processes a specially crafted WRL file, it reads past the end of an allocated structure. An attacker can leverage this condition to execute code in the context of the current process. The vulnerability is classified as an Out-of-Bounds Read [CWE-125]. Exploitation requires user interaction, since a victim must open the malicious file locally. Siemens published the issue in advisories SSA-583523 and SSA-645131 on October 8, 2024.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the user running Teamcenter Visualization or Tecnomatix Plant Simulation, compromising confidentiality, integrity, and availability of the host system.

Affected Products

Siemens Teamcenter Visualization V14.2 (all versions before V14.2.0.14), V14.3 (all versions before V14.3.0.12), and V2312 (all versions before V2312.0008)
Siemens Tecnomatix Plant Simulation V2302 (all versions before V2302.0016)
Siemens Tecnomatix Plant Simulation V2404 (all versions before V2404.0005)

Discovery Timeline

2024-10-08 - CVE-2024-45464 published to NVD
2024-10-08 - Siemens releases advisories SSA-583523 and SSA-645131
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45464

Vulnerability Analysis

The affected applications parse WRL files, a text-based 3D scene description format used for visualization and simulation workflows. During parsing, the affected code paths dereference data past the end of an allocated structure. This out-of-bounds read [CWE-125] returns adjacent heap memory to the parser. A crafted WRL file can influence how the parser interprets subsequent structure fields, corrupting control-flow-relevant state. The condition results in arbitrary code execution rather than a simple information disclosure or crash. Exploitation requires the victim to open the malicious file inside a vulnerable Teamcenter Visualization or Tecnomatix Plant Simulation client. The attack surface is client-side and local, but engineering workflows routinely exchange WRL assets between suppliers and partners.

Root Cause

The root cause is missing bounds validation while iterating parsed WRL structure fields. The parser assumes a well-formed record layout and reads beyond the boundary of the allocated buffer when the input deviates from expected sizes. Siemens has not published parser internals in the public advisory.

Attack Vector

An attacker delivers a malicious .wrl file through email, shared engineering repositories, supplier CAD exchanges, or removable media. The victim opens the file in an affected Siemens product. Parsing triggers the out-of-bounds read and enables code execution under the user account running the application. No network access to the target is required, and no privileges on the target host are needed by the attacker.

No public proof-of-concept exploit is available. See the Siemens Security Advisory SSA-583523 and SSA-645131 for vendor technical details.

Detection Methods for CVE-2024-45464

Indicators of Compromise

Unexpected child processes spawned by TcVis.exe, PlantSimulation.exe, or related Teamcenter and Tecnomatix binaries after a WRL file is opened.
Application crashes or Windows Error Reporting entries generated during WRL file parsing on unpatched hosts.
Inbound .wrl attachments from untrusted senders or from suppliers outside normal engineering exchange channels.

Detection Strategies

Alert on process-lineage anomalies where Siemens visualization or simulation executables launch scripting hosts, cmd.exe, powershell.exe, or network utilities.
Inspect file gateways and mail security for .wrl attachments and flag those originating from external or unverified sources.
Correlate endpoint file-open telemetry with subsequent process creation and outbound network activity within a short time window.

Monitoring Recommendations

Track installed versions of Teamcenter Visualization and Tecnomatix Plant Simulation across engineering workstations and prioritize hosts below the fixed builds.
Monitor for module load anomalies inside the Siemens processes, including unsigned DLLs loaded shortly after opening WRL content.
Review EDR telemetry for memory-integrity or exception events tied to WRL file handling in the affected products.

How to Mitigate CVE-2024-45464

Immediate Actions Required

Upgrade Teamcenter Visualization to V14.2.0.14, V14.3.0.12, or V2312.0008 or later depending on the installed branch.
Upgrade Tecnomatix Plant Simulation to V2302.0016 or V2404.0005 or later.
Instruct engineering users to open WRL files only from trusted sources and to validate the origin of supplier-provided 3D assets.

Patch Information

Siemens has released fixed versions for all affected products. Refer to Siemens Security Advisory SSA-583523 for Teamcenter Visualization updates and Siemens Security Advisory SSA-645131 for Tecnomatix Plant Simulation updates. Apply the vendor-provided installers through standard change management for engineering workstations.

Workarounds

Avoid opening WRL files from untrusted or unverified sources until patches are deployed.
Restrict receipt of .wrl files at email and file-transfer gateways for users who do not require them.
Run affected applications under least-privilege accounts to limit the impact of code execution in the parser process.