CVE-2024-24925: 
Siemens Simcenter Femap vulnerability analysis and mitigation

A vulnerability (CVE-2024-24925) has been identified in Simcenter Femap (versions prior to V2306.0000). The vulnerability is related to uninitialized pointer access while parsing specially crafted Catia MODEL files. This vulnerability was discovered and reported through the Zero Day Initiative (ZDI-CAN-22060) and was publicly disclosed on February 13, 2024 (Siemens Advisory, ZDI Advisory).

The vulnerability is classified as Access of Uninitialized Pointer (CWE-824). It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Additionally, it has a CVSS v4.0 base score of 7.3 with the vector string CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Siemens Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The attack requires user interaction, specifically opening a malicious Catia MODEL file (CISA Advisory, ZDI Advisory).

Siemens has released updates to address this vulnerability and recommends updating to version V2306.0000 or later. As a workaround, users are advised not to open untrusted Catia MODEL files using Simcenter Femap. Additionally, Siemens recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' operational guidelines for industrial security (Siemens Advisory).