PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-52574 Siemens CVE debrief

CVE-2024-52574 is a high-severity out-of-bounds read vulnerability in Siemens Teamcenter Visualization affecting versions V14.2, V14.3, V2312, and V2406. The flaw occurs when parsing specially crafted WRL (VRML) files, allowing an attacker to execute arbitrary code in the context of the current process. Published on December 10, 2024, and last modified on May 6, 2025, this vulnerability was reported through the Zero Day Initiative (ZDI-CAN-24543). The CVSS 3.1 score of 7.8 reflects high impacts to confidentiality, integrity, and availability, with a local attack vector requiring user interaction. Siemens has released patched versions for all affected product lines, and CISA recommends applying these updates immediately while avoiding untrusted WRL files as an interim mitigation.

Vendor
Siemens
Product
Teamcenter Visualization V14.2
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-10
Original CVE updated
2025-05-06
Advisory published
2024-12-10
Advisory updated
2025-05-06

Who should care

Organizations using Siemens Teamcenter Visualization for CAD data visualization, particularly in manufacturing, aerospace, automotive, and industrial engineering sectors. Security teams defending OT/ICS environments with design engineering workstations, as well as IT administrators managing product lifecycle management (PLM) infrastructure should prioritize patching.

Technical summary

The vulnerability stems from an out-of-bounds read condition during parsing of WRL (VRML) files in Siemens Teamcenter Visualization. When the application processes a malformed WRL file, it reads beyond the bounds of an allocated memory structure. This memory safety defect can be exploited to achieve arbitrary code execution within the context of the current user process. The attack requires local access with user interaction (opening a malicious file), making it suitable for targeted phishing or supply chain attacks against engineering workflows. The vulnerability affects four major product versions indicating widespread impact across Siemens' visualization product line.

Defensive priority

high

Recommended defensive actions

  • Apply vendor patches immediately: update Teamcenter Visualization V14.2 to V14.2.0.14 or later, V14.3 to V14.3.0.12 or later, V2312 to V2312.0008 or later, and V2406 to V2406.0005 or later
  • Implement application whitelisting to restrict execution of untrusted Teamcenter Visualization instances
  • Train users to avoid opening WRL files from untrusted sources and verify file origins before parsing
  • Deploy endpoint detection and response (EDR) solutions with behavioral monitoring for CAD visualization applications
  • Consider network segmentation for systems running Teamcenter Visualization to limit lateral movement potential

Evidence notes

Vulnerability disclosed via CISA ICS advisory ICSA-24-347-09 with Siemens SSA-645131 as primary source. Affects WRL file parsing in Teamcenter Visualization. ZDI reference ZDI-CAN-24543 indicates coordinated disclosure through Zero Day Initiative.

Official resources

2024-12-10