CVE-2024-47196 Siemens CVE debrief

Who should care

Organizations using Siemens ModelSim or Questa for hardware design and verification, particularly in environments where simulation tools are executed by privileged accounts or automated build systems. Security teams managing industrial control system development environments and semiconductor design facilities should prioritize this fix.

Technical summary

The vsimk.exe component in Siemens ModelSim and Questa simulation environments loads a specific Tcl configuration file from the current working directory rather than a protected system location. When privileged users or automated processes with elevated rights execute vsimk.exe from directories writable by lower-privileged users, an attacker with local access can place a malicious Tcl file in that directory. This file will be loaded and executed with the privileges of the vsimk.exe process, enabling arbitrary code execution and privilege escalation. The vulnerability requires authenticated local access and user interaction, with high attack complexity due to the specific conditions needed for exploitation.

Defensive priority

medium

Recommended defensive actions

• Apply vendor fix: Update Siemens ModelSim and Questa to version 2024.3 or later
• Harden application servers to prevent local access by untrusted personnel
• Ensure vsimk.exe is not launched from user-writable directories by privileged accounts
• Implement principle of least privilege for simulation tool execution environments
• Review and restrict directory permissions where simulation tools are executed
• Monitor for unauthorized Tcl file placement in working directories used by simulation tools

Evidence notes

Vulnerability confirmed through CISA ICS advisory ICSA-24-284-05 and Siemens security advisory SSA-426509. Affected products identified as ModelSim and Questa via CSAF product tree. CVSS vector AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H sourced from official advisory. Vendor fix version V2024.3 or later specified in remediation data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.