CVE-2024-32060: 
Siemens Simcenter Femap vulnerability analysis and mitigation

A critical out-of-bounds read vulnerability (CVE-2024-32060) has been identified in Simcenter Femap (versions prior to V2406). The vulnerability exists in the parsing of specially crafted IGS files, which could potentially lead to code execution in the context of the current process. This vulnerability was discovered as part of a broader security assessment that identified multiple file parsing vulnerabilities in the software (Siemens Advisory, ZDI Advisory).

The vulnerability is classified as an out-of-bounds read (CWE-125) that occurs when parsing specially crafted IGS files. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and a CVSS v4.0 base score of 7.3 with the vector string CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability requires user interaction to exploit, as the target must open a malicious file (Siemens Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The high severity scores indicate potential for complete compromise of system confidentiality, integrity, and availability when successfully exploited (ZDI Advisory).

The vulnerability requires local access and user interaction to exploit, specifically requiring a user to open a malicious IGS file. The attack complexity is considered low according to CVSS v3.1 scoring, though CVSS v4.0 rates it as high (Siemens Advisory).

Siemens has released version V2406 to address this vulnerability and recommends users update to this or a later version. As a temporary workaround, users are advised not to open untrusted IGS files in the affected applications. Additionally, Siemens recommends configuring the environment according to their operational guidelines for Industrial Security (Siemens Advisory).