{"schemaVersion":3,"id":"CVE-2021-46153","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). Affected application contains a memory corruption vulnerability while parsing NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14645, ZDI-CAN-15305, ZDI-CAN-15589, ZDI-CAN-15599)","dates":{"published":"2022-02-09T15:17:16.000Z","modified":"2024-08-04T05:02:11.274Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01564,"percentile":0.74874,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.01564},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01564,"percentile":0.74874}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01564,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01564,"percentile":0.74874}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"},{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"siemens","product":"simcenter_femap","name":"simcenter femap","label":"simcenter_femap","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2020.2","noFixRecorded":false,"fixedIn":null},{"text":"2020.2:maintenance_pack1","noFixRecorded":false,"fixedIn":null},{"text":"2020.2:maintenance_pack2","noFixRecorded":false,"fixedIn":null},{"text":"2020.2:maintenance_pack3","noFixRecorded":false,"fixedIn":null},{"text":"2021.1","noFixRecorded":false,"fixedIn":null},{"text":"2021.1:maintenance_pack1","noFixRecorded":false,"fixedIn":null},{"text":"2021.1:maintenance_pack2","noFixRecorded":false,"fixedIn":null},{"text":"2021.1:maintenance_pack3","noFixRecorded":false,"fixedIn":null}],"versionsText":"2020.2 | 2020.2:maintenance_pack1 | 2020.2:maintenance_pack2 | 2020.2:maintenance_pack3 | 2021.1 | 2021.1:maintenance_pack1 | 2021.1:maintenance_pack2 | 2021.1:maintenance_pack3","eol":null,"hubHref":"/vendor/siemens/simcenter_femap"},{"vendor":"siemens","product":"simcenter femap v2020.2","name":"Simcenter Femap V2020.2","label":"simcenter femap v2020.2","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":"/vendor/siemens/simcenter_femap_v20202"},{"vendor":"siemens","product":"simcenter femap v2021.1","name":"Simcenter Femap V2021.1","label":"simcenter femap v2021.1","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":"/vendor/siemens/simcenter_femap_v20211"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-609880.pdf","label":"cert-portal.siemens.com/productcert/pdf/ssa-609880.pdf","hostname":"cert-portal.siemens.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-22-299/","label":"www.zerodayinitiative.com/advisories/ZDI-22-299/","hostname":"www.zerodayinitiative.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-22-300/","label":"www.zerodayinitiative.com/advisories/ZDI-22-300/","hostname":"www.zerodayinitiative.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-22-297/","label":"www.zerodayinitiative.com/advisories/ZDI-22-297/","hostname":"www.zerodayinitiative.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-22-298/","label":"www.zerodayinitiative.com/advisories/ZDI-22-298/","hostname":"www.zerodayinitiative.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-02-09T15:17:16.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T05:02:11.274Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T13:28:01.481Z","stale":false,"partial":false}}