CVE-2024-24922: Simcenter Femap Buffer Overflow Vulnerability

CVE-2024-24922 Overview

CVE-2024-24922 is an out-of-bounds write vulnerability in Siemens Simcenter Femap affecting all versions prior to V2401.0000. The flaw exists in the application's parser for Catia MODEL files. When the parser processes a specially crafted file, it writes past the end of an allocated buffer. An attacker who convinces a user to open a malicious file can execute code in the context of the current process. The issue is tracked under Trend Micro Zero Day Initiative identifier ZDI-CAN-21715 and is classified as [CWE-787] Out-of-bounds Write.

Critical Impact
Successful exploitation enables arbitrary code execution on engineering workstations running vulnerable Simcenter Femap installations, potentially exposing sensitive CAD/CAE design data.

Affected Products

Siemens Simcenter Femap — all versions before V2401.0000
Windows engineering workstations running Simcenter Femap
Environments that import third-party Catia MODEL files into Femap

Discovery Timeline

2024-02-13 - CVE-2024-24922 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24922

Vulnerability Analysis

The vulnerability resides in the Catia MODEL file parsing routine within Simcenter Femap. Femap accepts several native and third-party geometry formats, including Catia MODEL, as import options for CAD interoperability. The parser fails to validate size or offset fields inside the MODEL structure before writing parsed data into an allocated memory buffer.

When an attacker supplies a crafted MODEL file, the parser writes attacker-controlled bytes past the buffer boundary. This corrupts adjacent heap or stack structures. Exploitation runs at the privilege level of the user opening the file, which on engineering workstations often includes access to proprietary design data, licenses, and connected network shares.

The attack requires local file access and user interaction, consistent with the file-open workflow used by CAD engineers. No authentication is required beyond the user session performing the import.

Root Cause

The root cause is missing bounds checking in the Catia MODEL parser, mapped to [CWE-787] Out-of-bounds Write. Length or index fields embedded in the file are trusted without validation against the destination buffer size. This allows the file to steer the parser into writing beyond the allocated region, corrupting memory in a way that can be shaped into control-flow hijack.

Attack Vector

Exploitation follows a client-side file-open pattern. An attacker delivers a malicious .model file through email, shared engineering repositories, contractor deliverables, or compromised supplier drops. When an engineer imports the file into Simcenter Femap, the parser triggers the out-of-bounds write and executes the attacker's payload in the Femap process context.

// No verified proof-of-concept code is publicly available for CVE-2024-24922.
// Refer to the Siemens ProductCERT advisory SSA-000072 for authoritative details.

Detection Methods for CVE-2024-24922

Indicators of Compromise

Unexpected child processes spawned by femap.exe such as cmd.exe, powershell.exe, or rundll32.exe following a file import
Crashes or abnormal termination of Simcenter Femap immediately after opening a Catia MODEL file
Inbound Catia MODEL files from untrusted senders or unverified supplier channels
Outbound network connections originating from the Femap process to unfamiliar external hosts

Detection Strategies

Monitor process lineage for Simcenter Femap and alert on any script interpreter or LOLBin executed as a child of femap.exe
Track file writes by femap.exe outside expected project directories, particularly to %APPDATA%, %TEMP%, and Startup locations
Correlate Femap crash telemetry with recent .model file access to surface potential exploitation attempts

Monitoring Recommendations

Enable Windows Defender Exploit Guard or equivalent memory-integrity controls on engineering workstations and forward events to a central SIEM
Log CAD file imports and their source paths so incident responders can retrieve suspect files for analysis
Baseline normal network egress from engineering workstations and alert on deviations tied to Femap sessions

How to Mitigate CVE-2024-24922

Immediate Actions Required

Upgrade Simcenter Femap to V2401.0000 or later on all engineering workstations
Inventory all hosts running Simcenter Femap and confirm patch status against V2401.0000
Restrict acceptance of Catia MODEL files to trusted, verified sources until patching is complete
Train CAD engineers to treat unsolicited .model attachments as suspicious and validate origin before opening

Patch Information

Siemens has released a fixed version in Simcenter Femap V2401.0000 and later. Details are available in the Siemens ProductCERT Advisory SSA-000072. Apply the update on every workstation running Femap; there is no server-side mitigation because the flaw is in the desktop parser.

Workarounds

Avoid opening Catia MODEL files from untrusted or unauthenticated sources
Open suspect files only in an isolated virtual machine or sandbox without access to production data or credentials
Apply application allowlisting to prevent femap.exe from launching script interpreters and other unexpected child processes
Run Femap under a standard user account, never with administrative privileges

bash

# Verify installed Simcenter Femap version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Simcenter Femap*" } |
  Select-Object DisplayName, DisplayVersion, Publisher