CVE-2024-32063: 
Siemens Simcenter Femap vulnerability analysis and mitigation

A type confusion vulnerability (CVE-2024-32063) was identified in Siemens Simcenter Femap (all versions prior to V2406). The vulnerability was discovered in the application's IGS file parsing functionality and was reported through the Zero Day Initiative (ZDI-CAN-21573). The vulnerability was disclosed on May 14, 2024, and affects the Simcenter Femap software, which is used for creating, editing, and inspecting finite element models of complex products or systems (Siemens Advisory, ZDI Advisory).

The vulnerability is classified as a type confusion vulnerability (CWE-843) that occurs during the parsing of IGS files. It has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Additionally, it received a CVSS v4.0 Base Score of 7.3 with the vector string CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Siemens Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The vulnerability requires user interaction, specifically opening a malicious IGS file, to be exploited (ZDI Advisory, Siemens Advisory).

The vulnerability requires local access and user interaction to be exploited. An attacker would need to convince a user to open a specially crafted IGS file with the affected application. The attack complexity is considered low according to CVSS v3.1 scoring, but high in CVSS v4.0 assessment (Siemens Advisory).

Siemens has released version V2406 to address this vulnerability and recommends users to update to this or a later version. As a workaround, users are advised not to open untrusted IGS files using Simcenter Femap. Additionally, Siemens recommends configuring the environment according to their operational guidelines for Industrial Security (Siemens Advisory).