CVE-2024-32064: 
Siemens Simcenter Femap vulnerability analysis and mitigation

A critical vulnerability (CVE-2024-32064) has been identified in Simcenter Femap (all versions prior to V2406). The vulnerability is characterized by an out-of-bounds read past the end of an allocated structure while parsing specially crafted IGS files. This security flaw was discovered and reported by Trend Micro Zero Day Initiative (ZDI-CAN-21575) (ZDI Advisory, Siemens Advisory).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) with a CVSS v3.1 Base Score of 7.8 (HIGH) and vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Additionally, it has a CVSS v4.0 Base Score of 7.3 (HIGH) with vector string CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability specifically affects the parsing mechanism of IGS files within the application (Siemens Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The attack requires user interaction, specifically opening a malicious IGS file (ZDI Advisory).

The vulnerability requires local access and user interaction to exploit. An attacker would need to convince a user to open a specially crafted IGS file with the affected application. The attack complexity is considered low according to CVSS v3.1, though CVSS v4.0 rates it as high (Siemens Advisory).

Siemens has released version V2406 to address this vulnerability and recommends users update to this or a later version. As a temporary workaround, users are advised not to open untrusted IGS files using Simcenter Femap. Additionally, Siemens recommends configuring the environment according to their operational guidelines for Industrial Security (Siemens Advisory).