CVE-2024-53977 Code injection in ModelSim

What is CVE-2024-53977?

CVE-2024-53977 is a medium-severity code injection vulnerability in Siemens ModelSim, published on 11 Feb 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example setup script contained in affected applications allows a specific executable file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges in installations where administrators or processes with elevated privileges launch the script from a user-writable directory.

Weakness: CWE-427

Which versions are affected by CVE-2024-53977?

It affects 2 products.

Products include Siemens Modelsim, Siemens Questa.

How do I fix CVE-2024-53977?

No fix has been published for CVE-2024-53977 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-53977 being exploited?

There is no known exploitation of CVE-2024-53977 in the wild and no public exploit code.

Other vulnerabilities in Siemens ModelSim

• CVE-2021-42023 Weak cryptography in ModelSim Simulation Medium 6.5
• CVE-2024-47194 Other in ModelSim Medium 5.4
• CVE-2024-47195 Path traversal in ModelSim Medium 5.4
• CVE-2024-47196 Path traversal in ModelSim Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rxxw-q6vh-r7c8.