CVE-2024-33654
📋 TL;DR
This vulnerability in Simcenter Femap allows attackers to execute arbitrary code by tricking users into opening malicious BMP files. All Simcenter Femap users running versions before V2406 are affected. The vulnerability exploits an out-of-bounds read during BMP file parsing.
💻 Affected Systems
- Simcenter Femap
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with the privileges of the Femap process, potentially leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Local privilege escalation or limited code execution within the Femap process context, potentially enabling further attacks or data exfiltration.
If Mitigated
Application crash or denial of service if memory protections prevent successful exploitation.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious file) and knowledge of the vulnerable BMP parsing routine.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V2406
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-064222.html
Restart Required: Yes
Instructions:
1. Download Simcenter Femap V2406 or later from Siemens support portal
2. Install the update following Siemens installation procedures
3. Restart the system to ensure all components are updated
🔧 Temporary Workarounds
Restrict BMP file handling
windowsBlock or restrict processing of BMP files in Femap through application settings or group policies
User awareness training
allTrain users to only open BMP files from trusted sources and verify file integrity
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Use endpoint protection with memory corruption detection capabilities
🔍 How to Verify
Check if Vulnerable:
Check Femap version in Help > About dialog - if version is below V2406, system is vulnerableCheck Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version shows V2406 or higher in Help > About dialog after update📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing BMP files
- Unexpected process creation from femap.exe
- Memory access violation errors in application logs
Network Indicators:
- Unusual outbound connections from Femap process
- File downloads of BMP files to Femap systems
SIEM Query:
Process Creation where Image contains 'femap.exe' and CommandLine contains '.bmp'