Summary
Siemens Simcenter Femap is affected by two vulnerabilities that could be triggered when the application reads modfem files. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to arbitrary code execution or data extraction on the target host system.
Siemens has released updates for Simcenter Femap and recommends to update to the latest version to fix the vulnerabilities. Siemens recommends to avoid opening of untrusted files from unknown sources.
Vulnerabilities 2
-
Unscored —
A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All…
-
Unscored —
A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All…
Revision history
-
#2
Revision - Fixing typos
-
#1
Publication Date
References
-
SSA-133038: Multiple Modfem File Parsing Vulnerabilities in Simcenter Femap - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-133038.txt
-
SSA-133038: Multiple Modfem File Parsing Vulnerabilities in Simcenter Femap - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-133038.pdf
-
ICS Advisory ICSA-21-159-12 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-159-12
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B