VulnerabilityAnalyzed

CVE-2024-53977

A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1).

MEDIUM 5.4EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example setup script contained in affected applications allows a specific executable file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges in installations where administrators or processes with elevated privileges launch the script from a user-writable directory.

CVSS 4.0: 5.4 MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.15% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-427
Affected: siemens/modelsim · siemens/questa
Source: productcert@siemens.com

References

https://cert-portal.siemens.com/productcert/html/ssa-637914.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.