PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-32062 Siemens CVE debrief

CVE-2024-32062 is a high-severity type confusion vulnerability in Siemens Simcenter Femap, published on 2024-07-09. The flaw occurs during parsing of IGS (Initial Graphics Exchange Specification) files and can lead to arbitrary code execution in the context of the current process. The vulnerability was reported through the Zero Day Initiative (ZDI-CAN-21568) and affects Simcenter Femap versions prior to V2406. Siemens has released a vendor fix in V2406 or later versions. CISA and Siemens recommend defensive mitigations including avoiding untrusted IGS files and applying the vendor update.

Vendor
Siemens
Product
Simcenter Femap
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-14
Original CVE updated
2024-05-14
Advisory published
2024-05-14
Advisory updated
2024-05-14

Who should care

Organizations using Siemens Simcenter Femap for engineering analysis and simulation, particularly those in industrial manufacturing, aerospace, automotive, and other sectors relying on CAD/CAE workflows. Security teams responsible for engineering workstation protection and supply chain security for design file exchanges should prioritize this vulnerability.

Technical summary

A type confusion vulnerability exists in Siemens Simcenter Femap when parsing IGS (Initial Graphics Exchange Specification) files. The vulnerability, tracked as ZDI-CAN-21568, allows an attacker to achieve arbitrary code execution in the context of the current process by providing a maliciously crafted IGS file. The CVSS 3.1 base score is 7.8 (HIGH), indicating significant impact to confidentiality, integrity, and availability with low attack complexity. The attack vector is local, requiring user interaction to open a malicious file. Siemens has addressed this vulnerability in V2406 and later versions.

Defensive priority

high

Recommended defensive actions

  • Apply vendor fix: Update Simcenter Femap to V2406 or later version
  • Avoid opening untrusted IGS files in affected applications
  • Avoid opening untrusted IGS, BDF, or BMP files using Simcenter Femap
  • Follow CISA ICS recommended practices for defense-in-depth security controls

Evidence notes

CVE published 2024-07-09 per official record. Type confusion vulnerability in IGS file parsing confirmed by CISA CSAF advisory ICSA-24-193-04 and Siemens security advisory SSA-064222. CVSS 3.1 score 7.8 (HIGH) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Vendor fix available in V2406 or later.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-32062 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-32062

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-32062 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-32062

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-193-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-064222.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-064222.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/pdf/ssa-064222.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/txt/ssa-064222.txt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.