PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-27438 Siemens CVE debrief

CVE-2025-27438 is a Siemens vulnerability in Teamcenter Visualization and Tecnomatix Plant Simulation that can be triggered while parsing specially crafted WRL files. The issue is an out-of-bounds read past the end of an allocated structure and, according to the advisory, could allow code execution in the context of the current process. Siemens and CISA list fixes for multiple product branches, and the vendor also advises not opening untrusted WRL files in affected applications.

Vendor
Siemens
Product
Teamcenter Visualization V14.3
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-11
Original CVE updated
2025-05-06
Advisory published
2025-03-11
Advisory updated
2025-05-06

Who should care

Administrators, engineers, and users responsible for Siemens Teamcenter Visualization and Tecnomatix Plant Simulation deployments should treat this as a priority patching item, especially where users routinely open externally sourced or untrusted 3D/visualization files.

Technical summary

The supplied advisory data describes a memory-safety flaw in WRL file parsing. When an affected application processes a specially crafted WRL file, it can read beyond the end of an allocated structure. The published impact is potential code execution in the current process. The CVSS vector provided is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack conditions with required user interaction.

Defensive priority

High. The vulnerability is rated 7.8 HIGH in the supplied data, affects six Siemens product/version branches, and has a potential code-execution impact if a user opens a malicious WRL file.

Recommended defensive actions

  • Update Teamcenter Visualization V14.3 to V14.3.0.13 or later.
  • Update Teamcenter Visualization V2312 to V2312.0009 or later.
  • Update Teamcenter Visualization V2406 to V2406.0007 or later.
  • Update Teamcenter Visualization V2412 to V2412.0002 or later.
  • Update Tecnomatix Plant Simulation V2302 to V2302.0021 or later.
  • Update Tecnomatix Plant Simulation V2404 to V2404.0010 or later.
  • Do not open untrusted WRL files in affected applications.
  • Use defense-in-depth and ICS security practices to reduce exposure while patching is in progress.

Evidence notes

All substantive claims are drawn from the supplied CISA CSAF advisory record for ICSA-25-072-01 and its cited Siemens references. The advisory was published on 2025-03-11 and revised on 2025-05-06 for typo fixes only. The affected products listed in the source are Teamcenter Visualization V14.3, V2312, V2406, V2412, and Tecnomatix Plant Simulation V2302 and V2404. The source does not list the vulnerability in KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-27438 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-27438

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-27438 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-27438

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-072-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-050438.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-050438.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-072-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.