Siemens Questa and ModelSim Privilege Escalation Vulnerability via Local Code Execution

A vulnerability exists in Siemens Questa and ModelSim, all versions prior to 2025.1, allowing authenticated local attackers to inject arbitrary code and escalate privileges. This issue arises from an example setup script that can load specific executable files from the current working directory. The vulnerability is exploitable in environments where administrators or processes with elevated privileges execute the script from a user-writable directory.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution with elevated privileges.

Remediation

Users are advised to update to version 2025.1 or later. For general security recommendations, consult Siemens' operational guidelines for Industrial Security.