CVE-2024-24920: Siemens Simcenter Femap RCE Vulnerability

CVE-2024-24920 Overview

CVE-2024-24920 is an out-of-bounds write vulnerability in Siemens Simcenter Femap affecting all versions prior to V2401.0000. The flaw resides in the application's parser for Catia MODEL files. A specially crafted file triggers a write past the end of an allocated buffer during parsing. Successful exploitation allows an attacker to execute arbitrary code in the context of the current process. The vulnerability is tracked as ZDI-CAN-21710 and is classified under [CWE-787] (Out-of-Bounds Write). Exploitation requires user interaction, such as opening a malicious file, and the attack vector is local.

Critical Impact
An attacker can achieve arbitrary code execution on an engineering workstation by convincing a user to open a crafted Catia MODEL file in Simcenter Femap.

Affected Products

Siemens Simcenter Femap — all versions prior to V2401.0000
Component: siemens:simcenter_femap
Fixed release: Simcenter Femap V2401.0000 and later

Discovery Timeline

2024-02-13 - CVE-2024-24920 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24920

Vulnerability Analysis

Simcenter Femap is a finite element modeling and analysis application used in engineering environments. The vulnerable code path processes Catia MODEL files, a proprietary CAD interchange format. During parsing, the application writes data past the end of an allocated buffer. This memory corruption can overwrite adjacent structures, including function pointers or control-flow metadata. An attacker who controls the file contents can influence the value and location of the write. The result is arbitrary code execution under the privileges of the user running Femap. Because engineers frequently exchange CAD files with external partners, crafted files can reach victims through routine collaboration workflows.

Root Cause

The root cause is missing bounds validation in the Catia MODEL file parser. The parser trusts size or offset fields from the file without verifying them against the allocated destination buffer. When those values exceed the buffer capacity, the write operation corrupts memory outside the intended region. This class of defect is tracked as [CWE-787].

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious .model file through email, shared storage, or a supply-chain source. When a user opens the file in Simcenter Femap, the parser processes attacker-controlled data and triggers the out-of-bounds write. No authentication is required on the target system beyond the user opening the file. Refer to the Siemens Security Advisory SSA-000072 for vendor technical detail.

Detection Methods for CVE-2024-24920

Indicators of Compromise

Unexpected crashes of femap.exe immediately after opening a .model file.
Creation of child processes by Simcenter Femap that are not part of normal engineering workflows, such as cmd.exe, powershell.exe, or rundll32.exe.
Outbound network connections from the Femap process to untrusted hosts following the opening of a CAD file.
Catia MODEL files arriving from unverified email senders or external file shares before a crash event.

Detection Strategies

Monitor process lineage for Simcenter Femap and alert on any spawned interpreter, script host, or LOLBin process.
Inspect Windows Error Reporting and application crash telemetry for repeated faults in the Femap parser modules.
Correlate file-open events for .model extensions with subsequent anomalous behavior on the same host.

Monitoring Recommendations

Enable endpoint telemetry that captures process creation, image load, and file-open events on engineering workstations.
Log and retain events for CAD application execution to support post-incident forensics.
Track version inventory of Simcenter Femap installations to identify hosts still running builds prior to V2401.0000.

How to Mitigate CVE-2024-24920

Immediate Actions Required

Upgrade all Simcenter Femap installations to V2401.0000 or later.
Restrict opening of Catia MODEL files to those received from verified, trusted sources.
Isolate engineering workstations from general-purpose network segments to limit blast radius if code execution occurs.
Communicate the risk to CAD users and provide guidance on handling untrusted files.

Patch Information

Siemens has released Simcenter Femap V2401.0000, which resolves the vulnerability. Consult the Siemens Security Advisory SSA-000072 for download instructions and additional remediation guidance.

Workarounds

Do not open Catia MODEL files from untrusted or unverified sources.
Apply application allowlisting to prevent Simcenter Femap from spawning shell or scripting processes.
Run Femap under a standard user account rather than an administrative account to reduce impact of successful exploitation.

bash

# Example: enumerate installed Femap versions on Windows hosts via PowerShell
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like 'Simcenter Femap*' } |
  Select-Object Name, Version, InstallDate