CVE-2024-32063
📋 TL;DR
A type confusion vulnerability in Simcenter Femap allows attackers to execute arbitrary code by tricking the application into misinterpreting data types while parsing malicious IGS files. This affects all Simcenter Femap users running versions before V2406, potentially leading to complete system compromise.
💻 Affected Systems
- Simcenter Femap
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining the same privileges as the Femap process, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to unauthorized access to engineering data, system manipulation, or installation of persistent malware.
If Mitigated
Limited impact with proper network segmentation and user privilege restrictions, potentially only affecting the local Femap process.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious IGS file. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V2406
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-064222.html
Restart Required: Yes
Instructions:
1. Download Simcenter Femap V2406 or later from Siemens support portal
2. Run the installer with administrative privileges
3. Follow installation wizard prompts
4. Restart the system after installation completes
🔧 Temporary Workarounds
Restrict IGS file handling
windowsBlock or restrict IGS file processing in Femap through application settings or group policies
File extension filtering
windowsUse Windows Group Policy or endpoint protection to block execution of IGS files
🧯 If You Can't Patch
- Implement application whitelisting to restrict Femap execution to trusted locations
- Use network segmentation to isolate Femap systems from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check Femap version via Help > About in the application interfaceCheck Version:
Not applicable - check via GUI onlyVerify Fix Applied:
Verify version is V2406 or later in Help > About dialog📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of femap.exe
- Unusual file access patterns to IGS files
- Suspicious child processes spawned from femap.exe
Network Indicators:
- Outbound connections from femap.exe to unexpected destinations
- DNS queries for suspicious domains from Femap systems
SIEM Query:
Process Creation where Image ends with 'femap.exe' and CommandLine contains '.igs'