PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-41908 Siemens CVE debrief

CVE-2024-41908 is a high-severity out-of-bounds read vulnerability in Siemens NX, a widely used computer-aided design (CAD) and manufacturing software. The flaw exists in the application's parsing of specially crafted PRT (part) files, which are native Siemens NX file formats. When exploited, this vulnerability can cause application crashes or potentially enable code execution within the context of the current process. The vulnerability was disclosed on August 13, 2024, through coordinated advisories from CISA and Siemens. The CVSS 3.1 score of 7.8 reflects high impacts to confidentiality, integrity, and availability, with a local attack vector requiring user interaction. Siemens has released a vendor fix in version V2406.3000 or later. Organizations using Siemens NX should prioritize updating affected installations and implement defensive measures to prevent exposure to untrusted PRT files.

Vendor
Siemens
Product
NX
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-08-13
Original CVE updated
2024-08-13
Advisory published
2024-08-13
Advisory updated
2024-08-13

Who should care

Organizations using Siemens NX for computer-aided design and manufacturing, particularly in industrial and critical infrastructure sectors. Security teams responsible for CAD/CAM/CAE software deployments, engineering workstation security, and industrial control system environments should prioritize this vulnerability.

Technical summary

The vulnerability stems from improper bounds checking during parsing of PRT (part) files in Siemens NX. Specially crafted PRT files can trigger an out-of-bounds read condition, which may result in application denial of service through crashes or, under certain conditions, arbitrary code execution within the security context of the running process. The attack requires local access and user interaction to open a malicious file. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local attack vector, low attack complexity, no privileges required, user interaction required, and high impacts across confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

  • Update Siemens NX to version V2406.3000 or later to address the out-of-bounds read vulnerability
  • Implement policies to prevent users from opening untrusted PRT files from unknown or unverified sources
  • Consider application sandboxing or privilege restrictions for Siemens NX processes where feasible
  • Monitor for anomalous application crashes in Siemens NX that may indicate exploitation attempts
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies in industrial control environments

Evidence notes

Vulnerability disclosed via CISA ICS advisory ICSA-24-228-09 and Siemens security advisory SSA-357412. Affected product confirmed as Siemens NX. Vendor fix available in V2406.3000 or later.

Official resources

2024-08-13