Summary
Siemens Simcenter Femap is affected by a vulnerability that could be triggered when the application reads modfem files. If a user is tricked to open a malicious file with the affected application, an attacker could leverage this vulnerability to leak information in the context of the current process.
Siemens recommends to update to the latest version line of Simcenter Femap (2021.2), which is not affected by this type of vulnerabilities. Siemens recommends to avoid opening of untrusted files from unknown sources.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). …
Revision history
-
#2
Revision - Fixing typos
-
#1
Publication Date
References
-
SSA-997732: Modfem File Parsing Vulnerability in Simcenter Femap before V2021.2 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-997732.txt
-
SSA-997732: Modfem File Parsing Vulnerability in Simcenter Femap before V2021.2 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-997732.pdf
-
ICS Advisory ICSA-21-257-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-257-04
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B