CVE-2021-27399
📋 TL;DR
This vulnerability in Simcenter Femap allows attackers to execute arbitrary code by exploiting an out-of-bounds write when parsing malicious FEMAP files. Users of Simcenter Femap 2020.2 and 2021.1 before specific maintenance packs are affected. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Simcenter Femap
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or remote code execution when users open malicious FEMAP files, potentially leading to malware installation or data exfiltration.
If Mitigated
Limited impact with proper file validation and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious FEMAP files. No public exploit code is available, but the vulnerability is documented by ZDI.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V2020.2.MP3 for 2020.2, V2021.1.MP3 for 2021.1
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-133038.pdf
Restart Required: Yes
Instructions:
1. Download the appropriate maintenance pack from Siemens support portal. 2. Close all Femap instances. 3. Run the maintenance pack installer. 4. Restart the system. 5. Verify the version is updated.
🔧 Temporary Workarounds
Restrict FEMAP file handling
windowsImplement application whitelisting to prevent execution of untrusted FEMAP files or restrict file associations.
User awareness training
allTrain users to only open FEMAP files from trusted sources and verify file integrity.
🧯 If You Can't Patch
- Implement strict file validation policies to block untrusted FEMAP files at network boundaries.
- Use application sandboxing or virtualization to isolate Femap execution from critical systems.
🔍 How to Verify
Check if Vulnerable:
Check Femap version via Help > About in the application interface or examine installed programs in Windows Control Panel.Check Version:
Not applicable - check via GUI or Windows Programs and FeaturesVerify Fix Applied:
Verify the version shows V2020.2.MP3 or higher for 2020.2, or V2021.1.MP3 or higher for 2021.1.📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes of femap.exe
- Unusual file access patterns to FEMAP files
- Process creation anomalies from femap.exe
Network Indicators:
- Unusual outbound connections from femap.exe process
SIEM Query:
Process: femap.exe AND (EventID: 1000 OR EventID: 1001) OR FileAccess: *.femap from untrusted sources