CVE-2024-24923
📋 TL;DR
This vulnerability allows remote code execution through specially crafted Catia MODEL files in Simcenter Femap. Attackers can exploit an out-of-bounds read vulnerability to execute arbitrary code in the context of the current process. All users of Simcenter Femap versions before V2401.0000 and V2306.0001 are affected.
💻 Affected Systems
- Simcenter Femap
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the Femap process, potentially leading to data theft, system manipulation, or lateral movement.
Likely Case
Remote code execution leading to malware installation, data exfiltration, or system disruption when users open malicious Catia files.
If Mitigated
Limited impact with proper file validation and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious Catia file. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V2401.0000 or V2306.0001
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-000072.html
Restart Required: Yes
Instructions:
1. Download the latest version from Siemens support portal. 2. Install the update following Siemens installation guide. 3. Restart the system after installation.
🔧 Temporary Workarounds
Restrict Catia file handling
windowsBlock or restrict processing of Catia MODEL files through application controls or file policies.
User awareness training
allTrain users to only open Catia files from trusted sources and verify file integrity.
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized Femap execution
- Use network segmentation to isolate Femap systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check Femap version via Help > About menu. If version is below V2401.0000 or V2306.0001, system is vulnerable.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify installed version is V2401.0000 or V2306.0001 or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of femap.exe
- Unusual file access patterns to Catia files
Network Indicators:
- Unexpected outbound connections from Femap process
SIEM Query:
Process: femap.exe AND (EventID: 1000 OR EventID: 1001) OR FileAccess: *.CATPart OR *.CATProduct