CVE-2024-24924: Siemens Simcenter Femap RCE Vulnerability

CVE-2024-24924 Overview

CVE-2024-24924 is an out-of-bounds write vulnerability in Siemens Simcenter Femap affecting all versions prior to V2306.0000. The flaw resides in the parser that processes Catia MODEL files. An attacker can craft a malicious MODEL file that, when opened by a user, writes past the end of an allocated buffer. Successful exploitation allows code execution in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-22059 and is tracked under [CWE-787]. Exploitation requires local file access and user interaction to open the crafted file.

Critical Impact
Attackers can achieve arbitrary code execution on engineering workstations by convincing users to open a specially crafted Catia MODEL file in Simcenter Femap.

Affected Products

Siemens Simcenter Femap, all versions prior to V2306.0000
File format affected: Catia MODEL files parsed by Simcenter Femap
Impacted platform: engineering workstations running vulnerable Femap installations

Discovery Timeline

2024-02-13 - CVE-2024-24924 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24924

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] that occurs when Simcenter Femap parses Catia MODEL files. The parser fails to validate size or offset values embedded in the file before writing data into a fixed-size heap or stack buffer. When a crafted MODEL file supplies attacker-controlled length fields, the parser writes attacker-controlled bytes past the allocated buffer.

This memory corruption can overwrite adjacent structures, function pointers, or object metadata. An attacker able to control the overflowing data can steer execution into attacker-supplied code. Because Femap runs as a full desktop application, the resulting execution occurs with the privileges of the user who opened the file.

Root Cause

The root cause is missing bounds validation during deserialization of the Catia MODEL binary structure. The parser trusts length or index fields from the file rather than validating them against the allocated destination buffer. Refer to the Siemens Security Advisory SSA-000072 for vendor detail.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a malicious .MODEL file through phishing, a shared engineering repository, a supply-chain drop, or a removable device. When an engineer opens the file in Simcenter Femap, the parser triggers the out-of-bounds write. Code executes with the user's privileges, enabling credential theft, lateral movement, or tampering with CAD and simulation data.

No verified public proof-of-concept is available. See the vendor advisory referenced above for technical details.

Detection Methods for CVE-2024-24924

Indicators of Compromise

Unexpected child processes spawned by femap.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
Simcenter Femap crashes or Windows Error Reporting entries citing access violations while opening .MODEL files.
Inbound Catia .MODEL files arriving from untrusted email senders, external file shares, or removable media.

Detection Strategies

Monitor process ancestry for femap.exe spawning interpreters, script hosts, or LOLBins immediately after a document open event.
Alert on memory-corruption telemetry such as heap or stack integrity violations within the Femap process.
Inspect file-open events for .MODEL extensions handled by Femap and correlate with subsequent suspicious behavior.

Monitoring Recommendations

Enforce version inventory queries against engineering workstations to identify Simcenter Femap builds below V2306.0000.
Log and review Catia MODEL file transfers across email gateways, file-share proxies, and endpoint DLP.
Retain EDR telemetry for engineering hosts long enough to reconstruct file-open to code-execution chains.

How to Mitigate CVE-2024-24924

Immediate Actions Required

Upgrade all Simcenter Femap installations to V2306.0000 or later as directed by Siemens.
Instruct engineering users not to open Catia .MODEL files received from untrusted or unverified sources.
Restrict execution of Simcenter Femap to standard user accounts without local administrator privileges.

Patch Information

Siemens has released Simcenter Femap V2306.0000, which remediates the out-of-bounds write in the Catia MODEL parser. Patch details and download references are published in the Siemens Security Advisory SSA-000072.

Workarounds

Block or quarantine .MODEL attachments at email and web gateways until patching is complete.
Open untrusted CAD files only inside isolated virtual machines with no network access or credentials.
Apply application-control policies that prevent Femap from launching command interpreters or script hosts.

bash

# Example: query installed Simcenter Femap version on Windows endpoints
reg query "HKLM\Software\Siemens\Simcenter Femap" /v Version