Buffer overflow in Siemens Simcenter Femap
CVE-2021-27387
A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27399. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12819)
Vulnerability class: Buffer Overflow
EPSS: 0.013 (68.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Siemens Simcenter_femap — versions 2020.2, 2021.1
- Siemens Simcenter Femap 2020.2 — versions All versions < V2020.2.MP3
- Siemens Simcenter Femap 2021.1 — versions All versions < V2021.1.MP3
Weakness classification (CWE)
References
- productcert@siemens.com (Patch, x_refsource_MISC, Vendor Advisory)
- productcert@siemens.com (VDB Entry, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-27387?
- CVE-2021-27387 is a high-severity vulnerability in Siemens Simcenter Femap, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2021-06-08.
- How severe is CVE-2021-27387?
- High severity. CVSS v3 base score is 7.8 out of 10.