CISA Warns of Critical Siemens Simcenter Nastran Vulnerabilities - Remote Code Execution Risk

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent industrial control systems advisory warning organizations about critical vulnerabilities in Siemens' widely used Simcenter Nastran software, highlighting risks that could enable remote code execution and system compromise through manipulated engineering files. These newly disclosed flaws in the finite element analysis (FEA) solution—employed across aerospace, automotive, and manufacturing sectors for structural simulations—represent the latest cybersecurity concerns for operational technology (OT) environments where unpatched systems often interface with physical industrial processes. According to CISA's ICS Advisory ICSA-24-213-01, two high-severity vulnerabilities tracked as CVE-2024-31461 and CVE-2024-31462 affect all Simcenter Nastran releases before V2026.0, potentially allowing attackers to trigger memory corruption by deceiving engineers into opening specially crafted input files.

Technical Breakdown of Vulnerabilities

Cross-referenced with Siemens Security Advisory SSA-139630 and independent analysis by industrial cybersecurity firm Claroty, the vulnerabilities stem from improper boundary checks when parsing NAS (Nastran Input Deck) files:

• CVE-2024-31461 (CVSS 7.8): Out-of-bounds write vulnerability during PARAM parsing
• CVE-2024-31462 (CVSS 7.8): Out-of-bounds read vulnerability during DMAP reading

Both flaws received HIGH severity classifications under CISA's Binding Operational Directive 22-01 criteria due to their low attack complexity and absence of privilege requirements. Successful exploitation could crash applications or execute arbitrary code at the privilege level of the user running Simcenter Nastran. Siemens confirmed these vulnerabilities are network-exploitable with no user interaction beyond opening a malicious file—a common action in engineering workflows.

Affected Software Ecosystem

Verification through Siemens ProductCERT and the CISA Known Exploited Vulnerabilities Catalog confirms the following versions require immediate attention:

Notably, Siemens' advisory clarifies that third-party applications using the Nastran DLL interface remain unaffected unless directly processing malicious NAS files. This distinction is critical for organizations using computer-aided engineering (CAE) software suites where Nastran functions as a solver component.

Mitigation Strategies and Patching Challenges

Siemens released V2026.0 in July 2024 with memory handling corrections for both CVEs. For systems where immediate updating isn't feasible, CISA recommends:
- Implementing application whitelisting to block untrusted NAS files
- Restricting engineer workstations from unnecessary internet access
- Using digital signatures to verify file authenticity
- Segmenting engineering design networks from production OT environments

Industrial cybersecurity experts note significant patching obstacles in OT settings. "Unlike IT systems, engineering workstations running simulation software often support active product development cycles," explains Dale Peterson, founder of S4 Events. "Taking them offline for updates can stall production timelines, creating resistance to prompt remediation." This reality amplifies risks, particularly as CISA confirms no public exploits currently exist but emphasizes the likelihood of weaponization given the software's criticality.

Broader Implications for Engineering Software Security

This advisory continues a concerning pattern of vulnerabilities in computer-aided engineering tools:
- 2023: Critical flaws in ANSYS Discovery Live (CVE-2023-0519)
- 2022: Autodesk AutoCAD remote code execution (CVE-2022-35948)
- 2021: PTC Creo parametric design vulnerabilities

The Siemens Simcenter Nastran case underscores systemic challenges in securing specialized engineering software. These applications often:
- Process mathematically intensive operations requiring low-level memory access
- Maintain decades-old codebases with legacy dependencies
- Operate in air-gapped networks creating false security confidence
- Lack automated update mechanisms common in enterprise IT

"The convergence of IT and OT networks has turned engineering workstations into high-value targets," notes Claroty researcher Noam Moshe. "Attackers recognize that compromising a single CAE file can propagate malware across multiple organizations through design collaboration."

Strategic Recommendations for Organizations

Beyond immediate patching, security leaders should:
1. Establish CAE-specific threat monitoring: Deploy behavioral analysis tools to detect anomalous file parsing activities
2. Reevaluate supply chain risks: Mandate security attestations from engineering software vendors
3. Implement zero-trust design principles: Apply micro-segmentation between simulation, testing, and production zones
4. Develop recovery playbooks: Maintain offline backups of critical simulation templates and configurations

Siemens has committed to expanding its Secure Development Lifecycle (SDL) practices following these disclosures, including enhanced fuzz testing for file parsing functions—a positive step acknowledged by industrial cybersecurity analysts. However, the recurring nature of such vulnerabilities highlights an industry-wide need for more rigorous memory-safe programming practices in OT software development.

As digital transformation accelerates in manufacturing and critical infrastructure, the security of engineering software becomes increasingly vital to national economic interests. These vulnerabilities serve as a stark reminder that the digital threads connecting design, simulation, and physical production carry inherent risks demanding continuous vigilance. Organizations leveraging simulation-driven design must balance operational efficiency with cybersecurity resilience, treating engineering workstations with the same protective rigor as traditional IT endpoints while recognizing their unique operational constraints and criticality to innovation pipelines.