PT-2024-1965 · Siemens · Simcenter Femap

Published 2024-02-13 · Updated 2024-10-03 · CVE-2024-24925

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simcenter Femap versions prior to V2306.0000

Description A vulnerability has been identified in Simcenter Femap, where the application is vulnerable to uninitialized pointer access while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process by opening a specially formed file.

Recommendations For versions prior to V2306.0000, update to version V2306.0000 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Catia MODEL files from untrusted sources until the update is applied. Restrict access to the file parsing functionality to minimize the risk of exploitation.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2024-01791

CVE-2024-24925

ZDI-24-181

Affected Products

Simcenter Femap

References · 10

• https://cert-portal.siemens.com/productcert/html/ssa-000072.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24925 · Security Note
• https://bdu.fstec.ru/vul/2024-01791 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-181 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24925 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1757370591970001086 · Twitter Post
• https://vuldb.com/?id.253558 · Note
• https://twitter.com/CVEnew/status/1757332536064090542 · Twitter Post
• http://zerodayinitiative.com/advisories/ZDI-24-181 · Note
• https://cybersecurity-help.cz/vdb/SB2024021427 · Note