CVE-2021-46159
📋 TL;DR
This vulnerability allows remote code execution through specially crafted NEU files in Simcenter Femap engineering software. Attackers can exploit an out-of-bounds write vulnerability to execute arbitrary code with the privileges of the current user. Organizations using Simcenter Femap V2020.2 or V2021.1 for engineering analysis are affected.
💻 Affected Systems
- Simcenter Femap
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary code, install malware, pivot to other systems, and potentially disrupt engineering operations.
Likely Case
Local privilege escalation leading to data theft, system manipulation, or ransomware deployment within the engineering environment.
If Mitigated
Limited impact through application sandboxing or restricted user privileges, potentially resulting in application crash rather than code execution.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious NEU file. No public exploit code is available as of the advisory dates.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to V2022.1 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-609880.pdf
Restart Required: Yes
Instructions:
1. Download latest Femap version from Siemens support portal. 2. Uninstall current vulnerable version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Restrict NEU file handling
windowsBlock or sandbox NEU file processing through application control policies
Windows AppLocker: New-AppLockerPolicy -RuleType Path -Action Deny -Path "*.neu" -User Everyone
User privilege reduction
windowsRun Femap with limited user privileges to reduce impact of successful exploitation
🧯 If You Can't Patch
- Implement strict file validation for NEU files before opening in Femap
- Isolate engineering workstations from critical network segments and implement network segmentation
🔍 How to Verify
Check if Vulnerable:
Check Femap version via Help > About. Vulnerable if version is exactly 2020.2 or 2021.1.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 2022.1 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening NEU files
- Unexpected process creation from femap.exe
Network Indicators:
- Unusual outbound connections from engineering workstations
SIEM Query:
Process Creation where Image ends with 'femap.exe' and CommandLine contains '.neu'