The vulnerabilities are out-of-bounds write, improper restriction of operations within the bounds of a memory buffer, out-of-bounds read, and access of uninitialized pointer.
Successful exploitation of this vulnerability, which Siemens self-reported, could allow an attacker to crash the application or execute arbitrary code if a user is tricked to open a malicious file on an affected product.
The following Siemens products suffer from the vulnerabilities:
- Simcenter Femap: Versions prior to V2401.0000 (CVE-2024-24920, CVE-2024-24921, CVE-2024-24922, CVE-2024-24923)
- Simcenter Femap: Versions prior to V2306.0001 (CVE-2024-24923)
- Simcenter Femap: Versions prior to V2306.0000 (CVE-2024-24924, CVE-2024-24925)
In one issue, the affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process.
CVE-2024-24920 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8.
A CVSS v4 score has also been calculated for CVE-2024-24920, which has a base score of 7.3.
In addition, the affected application is vulnerable to memory corruption while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-24921 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8.
A CVSS v4 score has also been calculated for CVE-2024-24921, which has a base score of 7.3.
Also, the affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process.
CVE-2024-24922 is the case number for this vulnerability, which has a CVSS v3 base score of 7.8.
A CVSS v4 score has also been calculated for CVE-2024-24922, which has a base score of 7.3.
Meanwhile, the affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process.
CVE-2024-24923 is the case number for the vulnerability, which has a CVSS v3 base score of 7.8.
A CVSS v4 score has also been calculated for CVE-2024-24923, which has a base score of 7.3.
In another issue, the affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process.
CVE-2024-24924 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.8.
A CVSS v4 score has also been calculated for CVE-2024-24924, which has a base score of 7.3.
In addition, the affected application is vulnerable to uninitialized pointer access while parsing specially crafted Catia MODEL files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVE-2024-24925 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.8.
A CVSS v4 score has also been calculated for CVE-2024-24925, which has a base score of 7.3.
The product sees use mainly in the critical manufacturing sector, and on a global basis.
No known exploits target these vulnerabilities. These vulnerabilities are not exploitable remotely. However, an attacker could leverage these low complexity vulnerabilities.
Siemens identified the following workarounds and mitigations users can apply to reduce risk:
- For CVE-2024-24920, CVE-2024-24921, CVE-2024-24922, CVE-2024-24923: Update to V2401.0000 or later versionÂ
- For CVE-2024-24923: Update to V2306.0001 or later versionÂ
- For CVE-2024-24924, CVE-2024-24925: Update to V2306.0000 or later versionÂ
Additionally, Siemens recommends users do not open untrusted Catia MODEL files from using Simcenter Femap.
As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.
For more information see the associated Siemens security advisory SSA-000072.