Siemens Simcenter Femap Heap Overflow RCE via Datakit CVE-2025-12659

Siemens Simcenter Femap Vulnerability Vulnerability Overview Vulnerability Name: CVE-2025-12659 Publish Date: May 14, 2026 Alert Code: ICSA-26-134-05 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: Siemens Simcenter Femap vers/intdot/<2512.0003 CVSS Score: v3 7.8 Vendor: Siemens Device: Siemens Simcenter Femap Vulnerability Type: Heap Buffer Overflow Remediation Recommendation: Upgrade to the latest version Background: - Critical Infrastructure Sector: Advanced Manufacturing - Deployed Countries/Regions: Global - Company Headquarters Location: Germany Vulnerability Details Vulnerability Description: Simcenter Femap is affected by a heap buffer overflow vulnerability in the Datakit library, which may be triggered when the application reads IPT format files. If a user is tricked into opening a malicious file, an attacker can exploit this vulnerability to execute remote code within the context of the current process. General Recommendations Cybersecurity Measures: Protect network-accessible devices and configure the environment in compliance with Siemens' Industrial Security Operating Guidelines. More Information: Visit the Siemens official website for more information. Additional Resources Contact Information: For further inquiries regarding Siemens products and security solutions, please contact Siemens ProductCERT. Best Practices Defense Measures: Minimize network exposure, isolate control devices, and use more secure remote access methods (e.g., VPN). Risk Assessment: Conduct appropriate impact analysis and risk assessment before deploying defense measures. Revision History Initial Publish Date: May 12, 2026 Revision Log: - 2026-05-12: Publish Date - 2026-05-14: Initial CISA Republishing of Siemens ProductCERT SSA-870926 Announcement Vendor Vendor: Siemens Tags Industry: Advanced Manufacturing Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Announcements Naxclow IoT Platform Yarbo Android/iOS Mobile Application and Cloud Infrastructure Brickcom Cameras Siemens KACO Blueplanet Inverters

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Simcenter Femap Heap Overflow RCE via Datakit CVE-2025-12659