ModelSim Vulnerability Could Allow Arbitrary Code Injection and Privilege Escalation

CVE-2024-47194

Summary

A local code injection vulnerability has been identified in Siemens’ ModelSim and Questa applications, specifically in the vish2.exe component. This vulnerability arises when the affected applications load a specific DLL file from the current working directory. If the vish2.exe process is executed from a user-writable directory by an authenticated local attacker, it could potentially lead to arbitrary code injection, allowing the attacker to escalate their privileges on systems where elevated privileges are involved. Users are advised to apply available patches and review directory permissions to mitigate this risk.

References