PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-32063 Siemens CVE debrief

CVE-2024-32063 is a high-severity type confusion vulnerability in Siemens Simcenter Femap, published on 2024-07-09. The flaw exists in the application's parsing of IGS (Initial Graphics Exchange Specification) files, where improper type handling during file processing can lead to arbitrary code execution within the context of the current process. This vulnerability was reported through the Zero Day Initiative (ZDI-CAN-21573) and affects engineering workstations where Simcenter Femap is deployed for finite element analysis and pre/post-processing tasks. The attack vector requires local access with user interaction—specifically, an attacker must convince a user to open a maliciously crafted IGS file. While not currently exploited in ransomware campaigns (not listed in CISA KEV), the vulnerability poses significant risk to industrial design and manufacturing environments where Simcenter Femap is commonly used. The CVSS v3.1 score of 7.8 reflects high impacts to confidentiality, integrity, and availability, though the need for user interaction limits the attack complexity.

Vendor
Siemens
Product
Simcenter Femap
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-14
Original CVE updated
2024-05-14
Advisory published
2024-05-14
Advisory updated
2024-05-14

Who should care

Engineering and manufacturing organizations using Siemens Simcenter Femap for finite element analysis; industrial design teams exchanging IGS geometry files; security teams protecting CAE/CAD workstations; OT security practitioners in discrete manufacturing sectors; organizations with supply chain partners sharing geometric models in IGS format

Technical summary

The vulnerability stems from a type confusion error in Simcenter Femap's IGS file parsing engine. When processing malformed IGS files, the application fails to properly validate object types during memory operations, potentially leading to out-of-bounds access or use-after-free conditions that an attacker can leverage for arbitrary code execution. The attack requires social engineering to deliver a malicious IGS file and convince a user to open it in Simcenter Femap. Successful exploitation grants code execution with the privileges of the Simcenter Femap process, typically running in the context of the logged-in user. The vulnerability is particularly relevant to industrial and manufacturing organizations using Simcenter Femap for CAE (Computer-Aided Engineering) workflows where IGS files are routinely exchanged between design and analysis teams.

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor fix: Update Simcenter Femap to V2406 or later version
  • Implement user awareness training on risks of opening untrusted IGS files from external sources
  • Configure endpoint protection to quarantine or block IGS files from untrusted origins
  • Restrict Simcenter Femap execution to standard user privileges (non-administrative) to limit code execution impact
  • Establish application control policies to prevent execution of untrusted IGS files in engineering environments
  • Monitor for anomalous process behavior following IGS file operations in Simcenter Femap
  • Review and validate IGS files through secondary tools before opening in production Simcenter Femap instances

Evidence notes

Vulnerability disclosed via CISA ICS Advisory ICSA-24-193-04 and Siemens Security Advisory SSA-064222. Type confusion vulnerability in IGS file parser confirmed by vendor. ZDI-CAN-21573 reference indicates coordinated disclosure through Zero Day Initiative.

Official resources

2024-07-09