File Parsing Vulnerabilities in Simcenter Femap before V2022.2

An attacker could execute arbitrary code on an engineering workstation if a user opens a malicious .NEU file, potentially compromising simulation data, design files, or enabling lateral movement to engineering networks and connected systems.

Engineering teams and analysts who use Siemens Simcenter Femap for finite element analysis, CAD design, and simulation work. This affects organizations in manufacturing, energy, automotive, and infrastructure sectors that rely on engineering workstations for system design and analysis.

An attacker crafts a malicious .NEU format file and tricks an engineer into opening it in Simcenter Femap. The out-of-bounds write vulnerability is triggered during file parsing, allowing the attacker to inject and execute code with the privileges of the user running Femap.