Arbitrary Code Execution Vulnerability in ModelSim and Questa by Siemens

CVE-2024-53977

Summary

A vulnerability exists in ModelSim and Questa that could allow an authenticated local attacker to execute arbitrary code. This occurs through a setup script within the affected applications that can load executable files from a current working directory. If an administrator or a process with elevated privileges initiates this script from a user-writable directory, the attacker could leverage this flaw to manipulate or escalate privileges, posing a significant security risk.

References