CVE-2022-41851

2022-10-1111:15:11

CWE-824

siemens

web.nvd.nist.gov

cve-2022-41851

vulnerability

jttk

simcenter femap

code execution

nvd

zdi-can-16973

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

23.6%

JSON

A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The JTTK library is vulnerable to an uninitialized pointer reference vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-16973)

Affected configurations

Nvd

Node

siemensjt_open_toolkitRange<11.1.1.0

siemenssimcenter_femapRange2022.1.0–2022.1.3

siemenssimcenter_femapRange2022.2.0–2022.2.2

VendorProductVersionCPE
siemensjt_open_toolkit*cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:*
siemenssimcenter_femap*cpe:2.3:a:siemens:simcenter_femap:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	jt_open_toolkit	*	cpe:2.3:a:siemens:jt_open_toolkit::::::::
siemens	simcenter_femap	*	cpe:2.3:a:siemens:simcenter_femap::::::::

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "JTTK",
    "versions": [
      {
        "version": "All versions < V11.1.1.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "Simcenter Femap V2022.1",
    "versions": [
      {
        "version": "All versions < V2022.1.3",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "Simcenter Femap V2022.2",
    "versions": [
      {
        "version": "All versions < V2022.2.2",
        "status": "affected"
      }
    ]
  }
]