CVE-2024-12836: Deltaww DRASimuCAD STP File RCE Vulnerability

CVE-2024-12836 Overview

CVE-2024-12836 is a type confusion vulnerability in Delta Electronics DRASimuCAD that allows attackers to execute arbitrary code on affected installations. The flaw resides in the parser for STP (STEP) files, a widely used CAD interchange format. Exploitation requires user interaction: the target must open a malicious STP file or visit a page delivering one. Successful exploitation lets an attacker run code in the context of the current process. The issue was reported through the Trend Micro Zero Day Initiative and tracked internally as ZDI-CAN-22450. It is classified under CWE-843: Access of Resource Using Incompatible Type.

Critical Impact
A single malicious STP file can trigger arbitrary code execution in the user's session, compromising engineering workstations that handle CAD assets in industrial environments.

Affected Products

Delta Electronics DRASimuCAD (all versions prior to the vendor fix)
Deployments on Windows engineering workstations processing STP/STEP files
Industrial and manufacturing environments using DRASimuCAD for robotic simulation

Discovery Timeline

2024-12-30 - CVE-2024-12836 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database
Vulnerability coordinated through Trend Micro Zero Day Initiative as ZDI-CAN-22450, published in advisory ZDI-24-1724

Technical Details for CVE-2024-12836

Vulnerability Analysis

DRASimuCAD parses STP files to import 3D geometry and assembly data. The parser fails to properly validate user-supplied data before interpreting it as a specific object type. When a crafted STP file supplies fields that do not match the expected type, the code operates on the data as if it were a different type. This mismatch corrupts internal state and hands attackers control over pointers, function tables, or object layout used later in execution.

Because the trigger is a file format the application is designed to open, exploitation blends into normal engineering workflows. Phishing emails carrying STP attachments, poisoned model libraries, and shared network drives are all realistic delivery channels for CAD environments.

Root Cause

The root cause is a CWE-843 type confusion condition in the STP file parsing logic. The parser trusts type metadata inside the file and dereferences objects without verifying that the actual runtime type matches the type it is being used as. Attackers craft STP entities that mislabel their type, and the parser then treats attacker-controlled bytes as pointers or vtable entries.

Attack Vector

The attack is local and requires user interaction. An attacker delivers a malicious STP file through email, a compromised model repository, or a web page that prompts the user to download and open the file. When DRASimuCAD parses the file, the type confusion triggers and hijacks execution in the user's context. There is no privilege escalation component in the flaw itself, so the attacker inherits the permissions of the logged-in engineer.

No verified public proof-of-concept code is available. Technical details are described in the ZDI-24-1724 advisory.

Detection Methods for CVE-2024-12836

Indicators of Compromise

Unexpected DRASimuCAD process crashes or hangs immediately after opening an STP file
DRASimuCAD spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by the DRASimuCAD process to unknown hosts
STP files arriving from external senders or sourced from untrusted model libraries

Detection Strategies

Monitor process lineage for DRASimuCAD spawning script interpreters or shell binaries, which is atypical for a CAD simulator
Alert on file writes to %APPDATA%, %TEMP%, or startup folders performed by the DRASimuCAD process
Inspect email gateways and file shares for STP attachments and correlate with subsequent endpoint activity
Track loading of unsigned or unusual DLLs into the DRASimuCAD process address space

Monitoring Recommendations

Enable full command-line and process-creation logging on engineering workstations running DRASimuCAD
Ingest endpoint telemetry into a centralized data lake to correlate STP file opens with post-execution behavior
Baseline normal DRASimuCAD network and file activity, then alert on deviations
Review Windows Application and WER crash logs for repeated faults in the DRASimuCAD parser modules

How to Mitigate CVE-2024-12836

Immediate Actions Required

Apply the vendor-supplied update for DRASimuCAD as soon as Delta Electronics publishes a fixed release
Instruct engineering staff to open STP files only from verified internal sources until patched
Block inbound STP attachments at the email gateway for users who do not require them
Restrict DRASimuCAD execution to standard user accounts, never administrators, to limit blast radius

Patch Information

Refer to the Zero Day Initiative advisory ZDI-24-1724 for coordination status and to Delta Electronics product security channels for the fixed version. No vendor advisory URL is listed in the current NVD entry. Verify the installed DRASimuCAD build matches or exceeds the patched version before allowing engineers to resume opening external STP files.

Workarounds

Quarantine STP files from external sources and require sandboxed review before opening in DRASimuCAD
Use application allow-listing to prevent DRASimuCAD from launching child processes such as shells and script hosts
Segment engineering workstations from general corporate networks and the internet to contain post-exploitation activity
Disable file-type associations that auto-open STP files in DRASimuCAD from browsers or mail clients

bash

# Example: block DRASimuCAD from spawning shell/script interpreters via WDAC or AppLocker
# AppLocker rule concept (PowerShell)
New-AppLockerPolicy -RuleType Publisher -User Everyone `
  -FilePath "C:\Program Files\Delta\DRASimuCAD\DRASimuCAD.exe" `
  -Action Deny -Optimize