CVE-2024-24925: Siemens Simcenter Femap RCE Vulnerability

CVE-2024-24925 Overview

CVE-2024-24925 is an uninitialized pointer access vulnerability in Siemens Simcenter Femap, a finite element analysis pre- and post-processor. The flaw resides in the application's parser for Catia MODEL files. When Simcenter Femap processes a specially crafted Catia MODEL file, it accesses a pointer that has not been properly initialized, enabling arbitrary code execution in the context of the current user process. All versions of Simcenter Femap prior to V2306.0000 are affected. The Zero Day Initiative tracked this issue as ZDI-CAN-22060 prior to CVE assignment. The vulnerability is classified under CWE-824: Access of Uninitialized Pointer.

Critical Impact
An attacker who convinces a Femap user to open a malicious Catia MODEL file can execute arbitrary code with the privileges of that user, leading to full compromise of the engineering workstation.

Affected Products

Siemens Simcenter Femap — all versions prior to V2306.0000
Component: Catia MODEL file parser within Simcenter Femap
Platform: Windows engineering workstations running Simcenter Femap

Discovery Timeline

2024-02-13 - CVE-2024-24925 published to the National Vulnerability Database (NVD)
2024-02-13 - Siemens published advisory SSA-000072
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24925

Vulnerability Analysis

Simcenter Femap imports geometry from third-party CAD formats, including Dassault Systèmes Catia MODEL files. The importer allocates and traverses data structures built from fields contained in the MODEL file. When a maliciously crafted MODEL file supplies unexpected or missing structural fields, one or more pointer variables remain uninitialized before the parser dereferences them. The parser then reads or writes memory through the uninitialized pointer.

Because the pointer value is derived from uninitialized stack or heap memory, an attacker who can influence adjacent memory contents can steer the dereference to an address of their choosing. This turns an information leak or crash into a write primitive suitable for arbitrary code execution. The process runs with the privileges of the interactive user, so a successful exploit yields code execution at that user's integrity level.

Root Cause

The root cause is [CWE-824: Access of Uninitialized Pointer]. The Catia MODEL parser fails to validate that all pointer fields referenced by a record are populated during parsing before those pointers are dereferenced. Missing sanity checks on structural fields in the file format allow a crafted file to skip initialization paths that would otherwise assign valid pointer values.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a weaponized .model file through email, a shared engineering repository, a supply-chain drop, or a compromised project archive. When an engineer opens or imports the file in Simcenter Femap, the vulnerable parser executes the attacker's shellcode within the Femap process. No network access to the target is required, and no privileges are needed prior to user interaction.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Siemens ProductCERT advisory SSA-000072 for vendor-supplied technical detail.

Detection Methods for CVE-2024-24925

Indicators of Compromise

Unexpected child processes spawned from femap.exe, particularly command interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
Crash dumps or Windows Error Reporting events referencing femap.exe and access violations at unusual addresses shortly after a Catia MODEL file is opened.
Inbound .model file attachments or downloads from untrusted sources arriving on engineering workstations.
Outbound network connections from femap.exe to non-Siemens infrastructure following the opening of a foreign MODEL file.

Detection Strategies

Hunt for process lineage where femap.exe is the parent of interactive shells, script hosts, or living-off-the-land binaries.
Correlate file-open telemetry for .model extensions with subsequent memory access violations or module loads inside the Femap process.
Flag Simcenter Femap installations reporting versions earlier than V2306.0000 via software inventory queries.

Monitoring Recommendations

Enable command-line and module-load logging on engineering workstations, and forward events to a centralized analytics platform for retrospective hunting.
Monitor the file-share paths and mail gateways used by CAD/CAE teams for the arrival of .model files from external senders.
Track Femap process integrity levels and network egress to detect post-exploitation lateral movement or C2 activity.

How to Mitigate CVE-2024-24925

Immediate Actions Required

Upgrade Simcenter Femap to version V2306.0000 or later on all engineering workstations.
Restrict opening of Catia MODEL files to those originating from trusted, authenticated sources, and validate file provenance before import.
Run Simcenter Femap under a standard user account rather than an administrator to limit the blast radius of successful exploitation.

Patch Information

Siemens fixed CVE-2024-24925 in Simcenter Femap V2306.0000. Download the patched release from the Siemens Support Center and consult Siemens Security Advisory SSA-000072 for full remediation guidance and additional CVEs addressed in the same release.

Workarounds

Do not open Catia MODEL files received from untrusted or unverified sources.
Apply Siemens' operational guidelines for securing industrial and engineering environments, including network segmentation of CAE workstations.
Enforce application allow-listing so that child processes spawned by femap.exe are constrained to expected binaries.
Use email and web gateway controls to quarantine .model file attachments pending manual review.

bash

# Example: query installed Simcenter Femap version on Windows endpoints
reg query "HKLM\SOFTWARE\Siemens\Femap" /v Version

# Example: block inbound .model attachments at an Exchange transport rule (pseudo-config)
New-TransportRule -Name "Quarantine Catia MODEL files" \
  -AttachmentExtensionMatchesWords "model" \
  -SetAuditSeverity High \
  -Quarantine $true