CVE-2024-32064
highPriorität · verfolgen · 0EPSS 0.004 · 33. PerzentilDEEUNLRUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21575)
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSimcenter Femapsiemens_psirt
Update to V2406 or later version
https://support.sw.siemens.com/ - BehobenPS/IGES Parasolid Translator Componentsiemens_psirt
Update to V27.1.215 or later version
https://ftp-cambridge.ugs.com - BehobenPS/IGES Parasolid Translator Componentcisa_csaf_ot
Update to V27.1.215 or later version
https://ftp-cambridge.ugs.com - BehobenSimcenter Femapcisa_csaf_ot
Update to V2406 or later version
https://support.sw.siemens.com/ - MitigationSimcenter Femapsiemens_psirt
Do not open untrusted IGS files in the affected applications
- MitigationPS/IGES Parasolid Translator Componentsiemens_psirt
Do not open untrusted IGS files from using PS/IGES Parasolid Translator Component
- MitigationPS/IGES Parasolid Translator Componentcisa_csaf_ot
Do not open untrusted IGS files from using PS/IGES Parasolid Translator Component
- MitigationSimcenter Femapcisa_csaf_ot
Do not open untrusted IGS files in the affected applications
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.4–7.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (11)
Betroffene Produkte und Versionsbereiche.
- ps_iges_parasolid_translator_componentalle Versionenncsc_nlNLcpe:2.3:a:siemens:ps_iges_parasolid_translator_component:0:*:*:*:*:*:*:*
- siemens ps/iges parasolid translator< 27.1.215nvdUScpe:2.3:a:siemens:ps\/iges_parasolid_translator:*:*:*:*:*:*:*:*
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2024-0282Kwetsbaarheden verholpen in Siemens ProductenNL2024-07-09csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDOM, SIMATIC, SINEMA, SIPROTEC en de Engineering Platforms voor diverse systemen.
- SSA-064222SSA-064222: Multiple File Parsing Vulnerabilities in Simcenter Femap before V24062024-07-09csaf · siemens_psirtDE
Simcenter Femap contains multiple file parsing vulnerabilities that could be triggered when the application reads files in IGS, BDF or BMP file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released a new version for Simcenter Femap and recommends to update to the latest version.
- SSA-976324SSA-976324: Multiple IGS File Parsing Vulnerabilities in PS/IGES Parasolid Translator Component before V27.1.2152024-05-14csaf · siemens_psirtDE
PS/IGES Parasolid Translator Component contains multiple file parsing vulnerabilities that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released a new version for PS/IGES Parasolid Translator Component and recommends to update to the latest version.
- ICSA-24-137-08Siemens PS/IGES Parasolid Translator Component2024-05-14icsa · cisa_csaf_otUS
PS/IGES Parasolid Translator Component contains multiple file parsing vulnerabilities that could be triggered when the application reads files in IGS file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released a new version for PS/IGES Parasolid Translator Component and recommends to update to the latest version.
- ICSA-24-193-04Siemens Simcenter Femap2024-07-09icsa · cisa_csaf_otUS
Simcenter Femap contains multiple file parsing vulnerabilities that could be triggered when the application reads files in IGS, BDF or BMP file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released a new version for Simcenter Femap and recommends to update to the latest version.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/html/ssa-064222.htmlcnnvd
- https://cert-portal.siemens.com/productcert/html/ssa-976324.htmlcnnvd
- https://cxsecurity.com/cveshow/CVE-2024-32064/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-32064cnnvd
- https://cert-portal.siemens.com/productcert/html/ssa-064222.htmlenisa_euvd
- https://cert-portal.siemens.com/productcert/html/ssa-976324.htmlenisa_euvd
- https://cert-portal.siemens.com/productcert/html/ssa-064222.htmlVendor Advisorynvd
- https://cert-portal.siemens.com/productcert/html/ssa-976324.htmlVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan