Remote Code Execution Vulnerability in Simcenter Amesim before V2021.1

An attacker could execute arbitrary code on systems running vulnerable versions of Simcenter Amesim, potentially compromising engineering workstations and gaining access to simulation models and control system design data.

Engineering teams and control system designers using Simcenter Amesim for simulation and modeling on workstations connected to corporate networks. This affects utilities and manufacturers that rely on Amesim for designing and validating process control logic before deployment to PLCs and DCS systems.

An attacker sends a specially crafted request to the unprotected SOAP endpoint exposed by Simcenter Amesim over the network. The SOAP service processes the request without authentication and performs insecure DLL loading, allowing the attacker to inject and execute a malicious DLL with the privileges of the Amesim process.