CVE-2024-32060 Siemens CVE debrief

Who should care

Engineering organizations using Siemens Simcenter Femap for finite element analysis and CAD preprocessing; security teams in manufacturing, aerospace, automotive, and energy sectors; ICS/OT security practitioners managing engineering workstations; asset owners with Simcenter Femap deployments in design and simulation workflows.

Technical summary

CVE-2024-32060 is an out-of-bounds read vulnerability in Siemens Simcenter Femap that occurs when parsing specially crafted IGS (Initial Graphics Exchange Specification) files. The vulnerability allows an attacker to read memory beyond allocated structure boundaries, potentially leading to code execution in the context of the current process. The flaw was reported through the Zero Day Initiative (ZDI-CAN-21565) and affects versions prior to V2406. The attack vector requires local access and user interaction—specifically, opening a malicious IGS file. Successful exploitation grants high impact on confidentiality, integrity, and availability. Siemens has released version V2406 as the definitive remediation. CISA's advisory ICSA-24-193-04 provides coordinated disclosure and mitigation guidance for industrial control systems environments.

Defensive priority

HIGH

Recommended defensive actions

• Update Simcenter Femap to version V2406 or later to remediate this vulnerability
• Apply vendor security updates from Siemens ProductCERT SSA-064222
• Restrict opening of untrusted IGS files in Simcenter Femap as a temporary mitigation
• Implement defense-in-depth controls for industrial control systems environments per CISA guidance
• Monitor for anomalous IGS file handling in engineering workstations running Simcenter Femap

Evidence notes

The vulnerability was reported through the Zero Day Initiative (ZDI-CAN-21565). CISA's CSAF-based advisory confirms the out-of-bounds read occurs during parsing of specially crafted IGS files in Simcenter Femap. Siemens ProductCERT SSA-064222 provides the authoritative vendor fix in version V2406.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.