Siemens Questa/ModelSim Local Code Execution Vulnerability (SSA-426509)

Key Information Vulnerability Description Vulnerability ID: SSA-426509 Affected Products: Questa and ModelSim (including OEM versions) Vulnerability Type: Multiple local code execution vulnerabilities Impact: Allows local attackers to inject arbitrary code and escalate privileges CVSS Scores: - CVSS v3.1 Base Score: 6.7 - CVSS v4.0 Base Score: 5.4 Affected Products and Solutions Affected Products: Questa/ModelSim Solution: Upgrade to version V2024.3 or later, and harden application servers to prevent local access by untrusted individuals. Workarounds and Mitigations Product-specific mitigations or workarounds can be found in the Affected Products and Solutions section. Follow general security recommendations. General Security Recommendations As a general security measure, Siemens strongly recommends protecting network access to devices and using appropriate security mechanisms. Configure the environment in accordance with Siemens’ Industrial Security Operational Guidelines (download: https://www.siemens.com/cert/operational-guidelines-industrial-security). Follow recommendations in the product manual. Vulnerability Description Description: Details all vulnerabilities in the affected application (CVE-IDs). Product-Specific Impact: Documents product-specific impacts for each vulnerability, where applicable. Acknowledgments Siemens thanks the following for their efforts: - ycdxsb for reporting the vulnerability - Intel PSIRT for coordination efforts Additional Information For further inquiries regarding security vulnerabilities in Siemens products and solutions, contact Siemens Product CERT: https://www.siemens.com/cert/advisories Historical Data V1.0 (2024-10-08): Release date Terms of Use Siemens security advisories are subject to Siemens’ license terms or other applicable agreements previously agreed upon with Siemens (hereinafter referred to as “License Terms”). To the extent applicable, the “Terms of Use” for software or documentation provided on Siemens’ global website (https://www.siemens.com/terms_of_use), particularly Sections 8–10, shall apply. In case of conflict, the License Terms shall prevail over the Terms of Use.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Questa/ModelSim Local Code Execution Vulnerability (SSA-426509)