CVE-2021-37176
mediumPriorität · verfolgen · 13EPSS 0.008 · 56. PerzentilDEEUUSEPSS · bewertet 2026-10-28
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). The femap.exe application lacks proper validation of user-supplied data when parsing modfem files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14260)
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSimcenter Femap V2020.2siemens_psirt
Update to V2021.2 or later version
- BehobenSimcenter Femap V2021.1siemens_psirt
Update to V2021.2 or later version
- BehobenSimcenter Femap V2020.2cisa_csaf_ot
Update to V2021.2 or later version
- BehobenSimcenter Femap V2021.1cisa_csaf_ot
Update to V2021.2 or later version
- MitigationSimcenter Femap V2020.2siemens_psirt
Do not open untrusted modfem files from unknown sources
- MitigationSimcenter Femap V2021.1siemens_psirt
Do not open untrusted modfem files from unknown sources
- MitigationSimcenter Femap V2020.2cisa_csaf_ot
Do not open untrusted modfem files from unknown sources
- MitigationSimcenter Femap V2021.1cisa_csaf_ot
Do not open untrusted modfem files from unknown sources
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.1–4.3
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (10)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-997732SSA-997732: Modfem File Parsing Vulnerability in Simcenter Femap before V2021.22021-09-14csaf · siemens_psirtDE
Siemens Simcenter Femap is affected by a vulnerability that could be triggered when the application reads modfem files. If a user is tricked to open a malicious file with the affected application, an attacker could leverage this vulnerability to leak information in the context of the current process. Siemens recommends to update to the latest version line of Simcenter Femap (2021.2), which is not affected by this type of vulnerabilities. Siemens recommends to avoid opening of untrusted files from unknown sources.
- ICSA-21-257-04Siemens Simcenter Femap2021-09-14icsa · cisa_csaf_otUS
Siemens Simcenter Femap is affected by a vulnerability that could be triggered when the application reads modfem files. If a user is tricked to open a malicious file with the affected application, an attacker could leverage this vulnerability to leak information in the context of the current process. Siemens recommends to update to the latest version line of Simcenter Femap (2021.2), which is not affected by this type of vulnerabilities. Siemens recommends to avoid opening of untrusted files from unknown sources.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-997732.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-37176cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-257-04cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.3096cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021091512cnnvd
- https://www.zerodayinitiative.com/advisories/ZDI-21-1073/cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-997732.pdfenisa_euvd
- https://www.zerodayinitiative.com/advisories/ZDI-21-1073/enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan