CISA republishes Siemens advisory on Simcenter buffer overflow
CISA republished a Siemens ProductCERT advisory on a stack-based buffer overflow affecting Siemens Simcenter Femap and Simcenter Nastran before V2606.
CISA on Aug. 18 republished a Siemens ProductCERT advisory on a stack-based buffer overflow in Siemens Simcenter Femap and Siemens Simcenter Nastran versions earlier than V2606.
The advisory says the flaw is tracked as CVE-2026-59086 and has a CVSS v3.1 base score of 7.8, marked high. CISA said the issue could allow an attacker to execute code in the context of the current process if a user is tricked into running an impacted application binary with a malicious string.
CISA mapped the issue to CWE-121, or stack-based buffer overflow. The agency said the affected products are used in critical manufacturing, the defense industrial base, energy, healthcare and public health, and transportation systems.
According to CISA, the vulnerability can be triggered when an application binary reads an arbitrary string as a file argument. The agency said the affected products are Siemens Simcenter Femap and Siemens Simcenter Nastran, both prior to V2606.
CISA’s advisory credits Michael Heinzl with reporting the vulnerability to Siemens ProductCERT. Siemens’ remediation is to update to V2606 or later, according to the notice.
CISA also repeated general guidance for control system users: minimize network exposure, keep control system networks behind firewalls, isolate them from business networks, and use VPNs carefully when remote access is needed.
The advisory page lists Siemens as the vendor and Germany as the company headquarters location. CISA said the notice on Aug. 18 was a republication of Siemens ProductCERT SSA-069220. The advisory timeline on the page lists an initial release date of Aug. 11 and a revision on Aug. 13 that added Simcenter Femap with a fix.
Users of affected versions are advised to update to V2606 or later. CISA’s page does not report a broader response or incident tied to the flaw.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()