CVE-2023-45601
📋 TL;DR
This vulnerability allows remote code execution through stack overflow when parsing malicious IGS files in Siemens Parasolid and Tecnomatix Plant Simulation software. Attackers can execute arbitrary code with the privileges of the current process. Organizations using affected versions of these CAD/CAM and simulation tools are at risk.
💻 Affected Systems
- Parasolid
- Tecnomatix Plant Simulation
📦 What is this software?
Parasolid by Siemens
Parasolid by Siemens
Parasolid by Siemens
Tecnomatix by Siemens
Tecnomatix by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary code, install malware, exfiltrate data, or pivot to other systems.
Likely Case
Local privilege escalation or remote code execution leading to data theft, system disruption, or ransomware deployment.
If Mitigated
Limited impact due to network segmentation, file type restrictions, and least privilege principles preventing successful exploitation.
🎯 Exploit Status
Exploitation requires user interaction to open malicious IGS file. No authentication needed for file parsing functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Parasolid V35.0.262, V35.1.250, V36.0.169; Tecnomatix Plant Simulation V2201.0009, V2302.0003
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
Restart Required: Yes
Instructions:
1. Download latest version from Siemens support portal. 2. Backup current installation. 3. Install update following vendor instructions. 4. Restart affected systems. 5. Verify successful update.
🔧 Temporary Workarounds
Restrict IGS file processing
allBlock or restrict processing of IGS files through application settings or group policies.
Implement file validation
allUse external tools to validate IGS files before processing in vulnerable applications.
🧯 If You Can't Patch
- Implement network segmentation to isolate affected systems
- Apply strict file type restrictions and user education about IGS file risks
🔍 How to Verify
Check if Vulnerable:
Check application version against affected versions list. Review if IGS file processing is enabled.Check Version:
Application-specific: Check 'About' dialog or use vendor-provided version checking tools.Verify Fix Applied:
Verify installed version matches or exceeds patched versions listed in vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing IGS files
- Unusual process creation from CAD applications
- Large stack overflow errors in application logs
Network Indicators:
- Unexpected outbound connections from CAD workstations
- File transfers containing IGS files to untrusted sources
SIEM Query:
Process creation where parent process contains 'parasolid' or 'plant simulation' AND command line contains '.igs'