PT-2022-2812 · Siemens · Simcenter Femap

Published 2022-03-22 · Updated 2022-07-15 · CVE-2022-27653

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simcenter Femap versions prior to V2022.2

Description A vulnerability has been identified in Simcenter Femap that could allow an attacker to execute code in the context of the current process. The issue is related to an out of bounds write past the end of an allocated structure while parsing specially crafted .NEU files. This can be exploited by creating and opening a specially crafted .NEU file, potentially allowing an attacker to execute arbitrary code.

Recommendations For versions prior to V2022.2, update to version V2022.2 or later to resolve the issue. As a temporary workaround, consider restricting the opening of .NEU files from untrusted sources to minimize the risk of exploitation. Avoid using the application to parse specially crafted .NEU files until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-03353

CVE-2022-27653

ZDI-22-1025

Affected Products

Simcenter Femap

References · 8

• https://zerodayinitiative.com/advisories/ZDI-22-1025 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-162616.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27653 · Security Note
• https://bdu.fstec.ru/vul/2022-03353 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27653 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-14 · Note
• https://cybersecurity-help.cz/vdb/SB2022051321 · Note
• https://vuldb.com/?id.200446 · Note