Cyber Posture

CVE-2025-23402

High

Published: 11 March 2025

Published
11 March 2025
Modified
23 September 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0009 26.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-23402 is a high-severity Use After Free (CWE-416) vulnerability in Siemens Teamcenter Visualization. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 26.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the use-after-free vulnerability by requiring timely application of vendor patches as specified in Siemens advisory SSA-050438.

prevent

Implements memory protection mechanisms like ASLR and DEP to prevent unauthorized code execution from use-after-free exploits during WRL file parsing.

prevent

Enforces validation of WRL file inputs to block specially crafted files from triggering the parsing-related use-after-free vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

The use-after-free vulnerability enables arbitrary code execution when parsing a malicious WRL file, directly mapping to T1203 (Exploitation for Client Execution) and T1204.002 (Malicious File under User Execution) as the user must open the crafted file.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009), Teamcenter Visualization V2406 (All versions < V2406.0007), Teamcenter Visualization V2412 (All versions < V2412.0002), Tecnomatix Plant Simulation V2302 (All versions…

more

< V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted WRL files. An attacker could leverage this vulnerability to execute code in the context of the current process.

Deeper analysisAI

CVE-2025-23402 is a use-after-free vulnerability (CWE-416) affecting multiple versions of Siemens Teamcenter Visualization and Tecnomatix Plant Simulation. Specifically, it impacts Teamcenter Visualization V14.3 (all versions prior to V14.3.0.13), V2312 (prior to V2312.0009), V2406 (prior to V2406.0007), and V2412 (prior to V2412.0002); as well as Tecnomatix Plant Simulation V2302 (prior to V2302.0021) and V2404 (prior to V2404.0010). The flaw is triggered when the affected applications parse specially crafted WRL files, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Published on March 11, 2025, it enables arbitrary code execution in the context of the current process.

An attacker with local access to a system running a vulnerable version can exploit this issue by convincing a user to open a maliciously crafted WRL file through the application, as it requires user interaction but no privileges. Low attack complexity allows exploitation with minimal effort, potentially leading to high-impact confidentiality, integrity, and availability violations within the process scope, such as data theft, modification, or denial of service.

Siemens security advisory SSA-050438, available at https://cert-portal.siemens.com/productcert/html/ssa-050438.html, provides details on the vulnerability and mitigation steps, including upgrading to the specified patched versions or later.

Details

CWE(s)

Affected Products

siemens
teamcenter visualization
14.0.0 — 14.3.0.13 · 2312.0 — 2312.0009 · 2406.0 — 2406.0007
siemens
tecnomatix plant simulation
2302.0 — 2302.0021 · 2404.0 — 2404.0010

CVEs Like This One

CVE-2025-23397Same product: Siemens Teamcenter Visualization
CVE-2025-23401Same product: Siemens Teamcenter Visualization
CVE-2025-27438Same product: Siemens Teamcenter Visualization
CVE-2025-23398Same product: Siemens Teamcenter Visualization
CVE-2025-23396Same product: Siemens Teamcenter Visualization
CVE-2025-23400Same product: Siemens Teamcenter Visualization
CVE-2025-23399Same product: Siemens Teamcenter Visualization
CVE-2026-23719Same vendor: Siemens
CVE-2026-23720Same vendor: Siemens
CVE-2026-23715Same vendor: Siemens

References