CVE-2024-32065
📋 TL;DR
This vulnerability in Simcenter Femap allows attackers to execute arbitrary code by exploiting an out-of-bounds read when parsing malicious IGS files. All users running Simcenter Femap versions before V2406 are affected. The attack occurs when the software processes specially crafted IGS files.
💻 Affected Systems
- Simcenter Femap
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, potentially leading to data theft, system takeover, or lateral movement within the network.
Likely Case
Local privilege escalation or application crash when users open malicious IGS files, potentially leading to data loss or system instability.
If Mitigated
Application crash without code execution if exploit fails or security controls block malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious IGS files. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V2406
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-064222.html
Restart Required: Yes
Instructions:
1. Download Simcenter Femap V2406 or later from Siemens support portal
2. Run the installer as administrator
3. Follow installation wizard prompts
4. Restart the system after installation completes
🔧 Temporary Workarounds
Restrict IGS file processing
windowsBlock or restrict processing of IGS files through application controls or file policies
User awareness training
allTrain users to only open IGS files from trusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized execution of Femap
- Use endpoint protection with file reputation services to block malicious IGS files
🔍 How to Verify
Check if Vulnerable:
Check Femap version via Help > About menu. If version is below V2406, system is vulnerable.Check Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is V2406 or later in Help > About menu and test IGS file processing functionality.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing IGS files
- Unexpected process creation from Femap executable
Network Indicators:
- Unusual outbound connections from Femap process
SIEM Query:
Process creation where parent_process contains 'femap' AND (process_name contains 'cmd' OR process_name contains 'powershell')