CVE-2024-24923: Siemens Simcenter Femap RCE Vulnerability

CVE-2024-24923 Overview

CVE-2024-24923 is an out-of-bounds read vulnerability in Siemens Simcenter Femap, a computer-aided engineering (CAE) application used for finite element analysis. The flaw exists in the parser that processes Catia MODEL files. Attackers can craft a malicious MODEL file that reads memory past the end of an allocated structure. Successful exploitation allows code execution in the context of the current process. The issue was reported through the Zero Day Initiative under advisory identifier ZDI-CAN-22055 and is tracked as [CWE-125].

Critical Impact
A crafted Catia MODEL file opened in a vulnerable Simcenter Femap version can lead to arbitrary code execution under the user's privileges.

Affected Products

Siemens Simcenter Femap — all versions prior to V2401.0000
Siemens Simcenter Femap — all versions prior to V2306.0001
Component identifier: siemens:simcenter_femap

Discovery Timeline

2024-02-13 - CVE-2024-24923 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24923

Vulnerability Analysis

Simcenter Femap parses Catia MODEL files as part of its CAD interoperability workflow. The parser reads structured records from the file and copies or references fields within an allocated in-memory structure. When a specially crafted MODEL file supplies malformed size or offset fields, the parser reads beyond the bounds of the allocated buffer. This out-of-bounds read [CWE-125] returns adjacent process memory to parser logic that treats the data as legitimate. The vulnerability requires user interaction: a target must open the malicious file locally. Exploitation results in code execution in the security context of the current user, giving an attacker the same file system and network privileges as the engineer running Femap.

Root Cause

The parser fails to validate size and offset fields inside Catia MODEL records against the actual bounds of the destination structure. Because Femap trusts values embedded in the file, an attacker-controlled length can drive read operations past the end of the allocation. The read data then influences downstream control flow, enabling memory disclosure and, ultimately, code execution.

Attack Vector

Exploitation requires an attacker to deliver a crafted Catia MODEL file to a Simcenter Femap user. Common delivery paths include email attachments, shared engineering repositories, and supplier data exchanges. The user must open the file in a vulnerable Femap build. No network access to the target is required, and no authentication to Femap is needed. See the Siemens Security Advisory SSA-000072 for vendor detail.

No verified public proof-of-concept code is available. The technical description in prose above reflects the mechanics described in the Siemens advisory and ZDI submission ZDI-CAN-22055.

Detection Methods for CVE-2024-24923

Indicators of Compromise

Unexpected crashes of femap.exe shortly after opening a .MODEL or Catia-format file
Child processes spawned by femap.exe that are inconsistent with normal CAE workflows, such as cmd.exe, powershell.exe, or scripting hosts
Inbound Catia MODEL files from untrusted email senders, external file shares, or supplier portals
Outbound network connections from the Femap process to unfamiliar destinations following file open events

Detection Strategies

Monitor engineering workstations for process-lineage anomalies where Femap spawns interactive shells, LOLBins, or code interpreters
Alert on file-write activity by femap.exe to autostart locations, Startup folders, or Run registry keys
Inspect email and file-share gateways for .MODEL attachments and correlate against sender reputation

Monitoring Recommendations

Enable EDR telemetry on all workstations running Simcenter Femap and retain process, file, and network events for correlation
Track installed Femap versions across the fleet and flag any hosts below V2401.0000 or V2306.0001
Review Femap crash dumps in Windows Error Reporting for signatures consistent with parser faults on Catia files

How to Mitigate CVE-2024-24923

Immediate Actions Required

Upgrade Simcenter Femap to V2401.0000 or later, or apply V2306.0001 on the V2306 branch
Inventory all engineering workstations running Femap and prioritize hosts that routinely process third-party CAD files
Instruct users to open Catia MODEL files only from trusted, verified sources until patching is complete

Patch Information

Siemens has published fixed builds and remediation guidance in Siemens Security Advisory SSA-000072. Upgrading to V2401.0000 or V2306.0001 (or later on each respective branch) removes the vulnerable parser code path. Coordinate updates with engineering teams to avoid disruption of active analysis projects.

Workarounds

Restrict Femap users to opening Catia MODEL files from vetted internal repositories only
Block or quarantine .MODEL file attachments at the email gateway pending patch deployment
Apply application allowlisting to prevent femap.exe from launching shells or scripting interpreters
Run Femap under standard user accounts, not administrators, to limit post-exploitation impact

bash

# Example: inventory Femap installations across Windows endpoints via PowerShell remoting
Invoke-Command -ComputerName (Get-Content .\hosts.txt) -ScriptBlock {
    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' |
        Where-Object { $_.DisplayName -like 'Simcenter Femap*' } |
        Select-Object PSComputerName, DisplayName, DisplayVersion, InstallLocation
} | Export-Csv -Path .\femap-inventory.csv -NoTypeInformation