CVE-2024-24925

At a glance

Severity: HIGH 7.8
EPSS: EPSS 0.31 % · percentile 24 (2026-10-27)
State: PUBLISHED
Published: 2024-02-13
Updated: 2024-08-01
Assigner: siemens
NVD status: Modified

Description

A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted Catia MODEL files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-22060)

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	siemens
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	HIGH 7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-824

European references

ENISA EUVD · EUVD-2024-22288
GCVE · GCVE-0-2024-24925

CERT-FR advisories

CERTFR-2024-AVI-0119 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:* < 2306.0000

Affected products

Product	Versions
Siemens · Simcenter Femap	affected 0 < V2306.0000

References

https://cert-portal.siemens.com/productcert/html/ssa-000072.html

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD