CVE-2024-45465: Siemens Tecnomatix Plant Simulation RCE

CVE-2024-45465 Overview

CVE-2024-45465 is an out-of-bounds read vulnerability affecting Siemens Teamcenter Visualization and Tecnomatix Plant Simulation. The flaw exists in the WRL (VRML) file parser used by these engineering applications. Parsing a specially crafted WRL file causes a read past the end of an allocated structure. An attacker can leverage this condition to execute code in the context of the current process. Exploitation requires the victim to open a malicious file, making phishing and supply-chain delivery the most likely attack paths against engineers and CAD operators. Siemens assigned this issue [CWE-125] and published fixes through advisories SSA-583523 and SSA-645131.

Critical Impact
A crafted WRL file can trigger memory disclosure and code execution within Siemens Teamcenter Visualization and Tecnomatix Plant Simulation, exposing engineering workstations and industrial design data.

Affected Products

Siemens Teamcenter Visualization V14.2 (versions prior to V14.2.0.14), V14.3 (prior to V14.3.0.12), and V2312 (prior to V2312.0008)
Siemens Tecnomatix Plant Simulation V2302 (versions prior to V2302.0016)
Siemens Tecnomatix Plant Simulation V2404 (versions prior to V2404.0005)

Discovery Timeline

2024-10-08 - CVE-2024-45465 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45465

Vulnerability Analysis

The vulnerability resides in the WRL (Virtual Reality Modeling Language) file parser bundled with Teamcenter Visualization and Tecnomatix Plant Simulation. WRL files describe 3D scene graphs and rely on structured node definitions parsed at load time. When the affected parser processes a malformed WRL structure, it reads memory past the end of an allocated buffer. This out-of-bounds read [CWE-125] can leak adjacent heap contents and corrupt parser state used for subsequent operations. Attackers can shape file contents so the disclosed memory or corrupted state redirects control flow, resulting in code execution under the identity of the user running the CAD or simulation application.

Root Cause

The parser fails to validate the length of nested WRL constructs against the size of the structure allocated to hold them. Missing boundary checks allow field reads to extend beyond the allocation. Because these engineering products run with user-level privileges that often include access to design repositories and Teamcenter data, a successful exploit exposes intellectual property and simulation configurations.

Attack Vector

Exploitation is local and requires user interaction: the victim must open an attacker-supplied WRL file inside one of the affected products. Delivery channels include phishing attachments, shared engineering libraries, and compromised supplier drops. No network exposure or authentication is required on the application itself. Siemens documents affected versions and fixes in SSA-583523 and SSA-645131.

No public proof-of-concept exploit code has been released for CVE-2024-45465, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics of the vulnerable parsing routine are described in the Siemens advisories referenced above.

Detection Methods for CVE-2024-45465

Indicators of Compromise

Unexpected crashes, hangs, or Windows Error Reporting entries generated by Tcvis.exe, PlantSimulation.exe, or related Teamcenter Visualization processes when opening .wrl files.
WRL files arriving from external senders, contractors, or unusual file shares, particularly those significantly smaller or larger than typical CAD exports.
Child processes such as cmd.exe, powershell.exe, or script hosts spawned by Teamcenter Visualization or Tecnomatix Plant Simulation.

Detection Strategies

Alert on unusual process lineage where CAD or simulation binaries spawn shells, script interpreters, or network utilities.
Inspect email and file-transfer gateways for .wrl attachments and flag those originating outside trusted engineering supply chains.
Correlate file open events on .wrl files with subsequent memory-access violations logged by the operating system.

Monitoring Recommendations

Enable process creation and command-line logging on engineering workstations and forward events to a central analytics platform.
Track version telemetry for Teamcenter Visualization and Tecnomatix Plant Simulation so unpatched hosts are visible to the security team.
Monitor access to shared repositories that host WRL and other 3D asset formats for anomalous read or write patterns.

How to Mitigate CVE-2024-45465

Immediate Actions Required

Upgrade Teamcenter Visualization to V14.2.0.14, V14.3.0.12, or V2312.0008 or later, matching the deployed branch.
Upgrade Tecnomatix Plant Simulation to V2302.0016 or V2404.0005 or later.
Restrict opening of WRL files to those received from trusted internal sources and validated engineering partners.
Apply application allowlisting so only approved versions of Teamcenter Visualization and Tecnomatix Plant Simulation execute on engineering endpoints.

Patch Information

Siemens has released fixed versions for all affected products. Refer to Siemens advisories SSA-583523 and SSA-645131 for download locations and integrity hashes. Apply the update that corresponds to the installed product branch, then verify the version string inside the About dialog before returning the workstation to production use.

Workarounds

Avoid opening WRL files from untrusted or unverified sources until patches are applied.
Segment engineering workstations from general corporate networks to contain post-exploitation activity.
Run Teamcenter Visualization and Tecnomatix Plant Simulation under a standard user account rather than an administrator to limit blast radius.

bash

# Configuration example: enumerate installed versions on Windows engineering hosts
Get-CimInstance Win32_Product | \
  Where-Object { $_.Name -match 'Teamcenter Visualization|Tecnomatix Plant Simulation' } | \
  Select-Object Name, Version, InstallDate