PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-23401 Siemens CVE debrief

CVE-2025-23401 is a high-severity Siemens vulnerability affecting Teamcenter Visualization V14.3, V2312, V2406, V2412 and Tecnomatix Plant Simulation V2302, V2404. Siemens and CISA say the flaw is an out-of-bounds read past the end of an allocated structure while parsing specially crafted WRL files. The advisory states this could allow code execution in the context of the current process. The advisory was published on 2025-03-11 and later revised on 2025-05-06 for typo fixes.

Vendor
Siemens
Product
Teamcenter Visualization V14.3
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-11
Original CVE updated
2025-05-06
Advisory published
2025-03-11
Advisory updated
2025-05-06

Who should care

Administrators, engineers, and support teams running the affected Siemens visualization or plant-simulation versions should pay attention, especially where WRL files can arrive from external partners, contractors, or other untrusted sources.

Technical summary

The issue is a memory-safety bug in WRL parsing: an out-of-bounds read past the end of an allocated structure. The supplied advisory links the condition to specially crafted WRL files and notes potential code execution in the current process. The provided CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating user interaction is required and the impact can be severe once triggered.

Defensive priority

High. The vulnerability is publicly disclosed, rated CVSS 7.8, and affects multiple active Siemens product lines. Prioritize patching systems that open or ingest WRL files, and reduce exposure to untrusted file input until remediation is complete.

Recommended defensive actions

  • Update Teamcenter Visualization V14.3 to V14.3.0.13 or later.
  • Update Teamcenter Visualization V2312 to V2312.0009 or later.
  • Update Teamcenter Visualization V2406 to V2406.0007 or later.
  • Update Teamcenter Visualization V2412 to V2412.0002 or later.
  • Update Tecnomatix Plant Simulation V2302 to V2302.0021 or later.
  • Update Tecnomatix Plant Simulation V2404 to V2404.0010 or later.
  • Do not open untrusted WRL files in affected applications until systems are updated.

Evidence notes

This debrief is grounded in the CISA CSAF advisory ICSA-25-072-01 and Siemens advisory SSA-050438, both listed in the supplied corpus. The source states the affected products, the WRL parsing weakness, the potential for code execution in the current process, and the fixed versions. The source timeline shows initial publication on 2025-03-11 and a later 2025-05-06 revision for typo fixes. No CISA KEV entry was provided for this CVE.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-23401 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-23401

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-23401 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-23401

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-072-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-050438.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-050438.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.