DATABASE RESOURCES PRICING ABOUT US

{"id": "ICSA-21-012-03", "vendorId": null, "type": "ics", "bulletinFamily": "info", "title": "Siemens JT2Go and Teamcenter Visualization (Update B)", "description": "## 1\\. EXECUTIVE SUMMARY\n\n * **CVSS v3 7.8**\n * **ATTENTION:** Low skill level to exploit\n * **Vendor:** Siemens\n * **Equipment: **JT2Go and Teamcenter Visualization\n\n**\\--------- Begin Update B Part 1 of 2 ---------**\n\n * **Vulnerabilities: **Type Confusion, Improper Restriction of XML External Entity Reference, Out-of-Bounds Write, Heap-based Buffer Overflow, Stack-based Buffer Overflow, ~~Untrusted Pointer Dereference~~, Out-of-Bounds Read\n\n**\\--------- End Update B Part 1 of 2 ---------**\n\n## 2\\. UPDATE INFORMATION\n\nThis updated advisory is a follow-up to the advisory update titled ICSA-21-012-03 Siemens JT2Go and Teamcenter Visualization (Update A) that was published February 9, 2021, to the ICS webpage on us-cert.cisa.gov.\n\n## 3\\. RISK EVALUATION\n\nSuccessful exploitation of these vulnerabilities could lead to arbitrary code execution.\n\n## 4\\. TECHNICAL DETAILS\n\n### 4.1 AFFECTED PRODUCTS\n\n**\\--------- Begin Update B Part 1 of 2 ---------**\n\nThe following products are affected:\n\n * JT2Go: All versions prior to v13.1.0\n * ~~JT2Go: Version 13.1.0. only affected by CVE-2020-26989, CVE-2020-26990, CVE-2020-26991~~\n * Teamcenter Visualization: All versions prior to v13.1.0\n * ~~Teamcenter Visualization: Version 13.1.0 only affected by CVE-2020-26989, CVE-2020-26990, CVE-2020-26991~~\n\n### 4.2 VULNERABILITY OVERVIEW\n\n[CVE-2020-26989](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26989>), [CVE-2020-26990](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26990>), and [CVE-2020-28383](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26383>) were moved to [SSA-663999](<https://www.siemens.com/cert/advisories>) and [ICSA-21-040-06](<https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06>). [CVE-2020-26991](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26991>) was moved to [SSA-695540](<https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf>) and [ICSA-21-147-04](<https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04>)\n\n**\\--------- End Update B Part 2 of 2 ---------**\n\n#### 4.2.1 [ACCESS OF RESOURCE USING INCOMPATIBLE TYPE (\u2018TYPE CONFUSION') CWE-843](<https://cwe.mitre.org/data/definitions/843.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing JT files. A crafted JT file can trigger a type of confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26980](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26980>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.2 [IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611](<https://cwe.mitre.org/data/definitions/611.html>)\n\nWhen opening a specially crafted XML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external DTD.\n\n[CVE-2020-26981](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26981>) has been assigned to this vulnerability. A CVSS v3 base score of 5.6 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L>)).\n\n#### 4.2.3 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing CG4 and CGM files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26982](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26982>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.4 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PDF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26983](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26983>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.5 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26984](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26984>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.6 [HEAP-BASED BUFFER OVERFLOW CWE-122](<https://cwe.mitre.org/data/definitions/122.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing RGB and SGI files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26985](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26985>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.7 [HEAP-BASED BUFFER OVERFLOW CWE-122](<https://cwe.mitre.org/data/definitions/122.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing JT files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26986](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26986>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.8 [HEAP-BASED BUFFER OVERFLOW CWE-122](<https://cwe.mitre.org/data/definitions/122.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing TGA files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26987](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26987>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.9 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26988](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26988>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.10 [STACK-BASED BUFFER OVERFLOW CWE-121](<https://cwe.mitre.org/data/definitions/121.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing CGM files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26992](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26992>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.11 [STACK-BASED BUFFER OVERFLOW CWE-121](<https://cwe.mitre.org/data/definitions/121.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing CGM files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font index handling. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26993](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26993>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.12 [HEAP-BASED BUFFER OVERFLOW CWE-122](<https://cwe.mitre.org/data/definitions/122.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PCX files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26994](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26994>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.13 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing SGI and RGB files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26995](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26995>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.14 [OUT-OF-BOUNDS READ CWE-125](<https://cwe.mitre.org/data/definitions/125.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing CG4 files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26996](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26996>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n### 4.3 BACKGROUND\n\n * **CRITICAL INFRASTRUCTURE SECTORS:** Critical Manufacturing\n * **COUNTRIES/AREAS DEPLOYED: **Worldwide\n * **COMPANY HEADQUARTERS LOCATION: **Germany\n\n### 4.4 RESEARCHER\n\nFrancis Provencher {PRL} and rgod, working with Trend Micro\u2019s Zero Day Initiative, and Carsten Eiram from Risk Based Security, reported these vulnerabilities.\n\n## 5\\. MITIGATIONS\n\nSiemens recommends the following:\n\n * JT2Go: Update to [v13.1.0 or later](<https://support.sw.siemens.com/>) (login required).\n * Teamcenter Visualization: Update to [v13.1.0 or later](<https://support.sw.siemens.com/>) (login required).\n * Limit the opening of untrusted files in systems where JT2Go or Teamcenter Visualization is installed.\n * Apply a [defense-in-depth](<https://www.siemens.com/Industrialsecurity>) concept to help reduce the probability for untrusted code to run on the system. \n\nFor additional information refer to [SSA-622830](<https://www.siemens.com/cert/advisories>), [SSA-663999](<https://www.siemens.com/cert/advisories>), and [SSA-695540](<https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf>)\n\nSiemens strongly recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to [Siemens\u2019 operational guidelines for Industrial Security](<https://www.siemens.com/cert/operational-guidelines%20industrial-security>) and follow the recommendations in the product manuals.\n\nAdditional information on industrial security by Siemens can be found at: <https://www.siemens.com/Industrialsecurity>\n\nCISA recommends users take the following measures to protect themselves from social engineering attacks:\n\n * Do not click web links or open unsolicited attachments in email messages.\n * Refer to [Recognizing and Avoiding Email Scams](<https://us-cert.cisa.gov/sites/default/files/publications/emailscams_0905.pdf>) for more information on avoiding email scams.\n * Refer to [Avoiding Social Engineering and Phishing Attacks](<https://us-cert.cisa.gov/ncas/tips/ST04-014>) for more information on social engineering attacks.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for [control systems security recommended practices](<https://us-cert.cisa.gov/ics/recommended-practices>) on the ICS webpage on [us-cert.cisa.gov](<https://us-cert.cisa.gov/ics>). Several recommended practices are available for reading and download, including [Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies](<https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf>).\n\nAdditional mitigation guidance and recommended practices are publicly available on the [ICS webpage on us-cert.cisa.gov](<https://us-cert.cisa.gov/ics>) in the Technical Information Paper, [ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies](<https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B>).\n\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.\n\nNo known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.\n", "published": "2021-05-27T12:00:00", "modified": "2021-05-27T12:00:00", "epss": [{"cve": "CVE-2020-26980", "epss": 0.00374, "percentile": 0.68767, "modified": "2023-06-06"}, {"cve": "CVE-2020-26981", "epss": 0.00859, "percentile": 0.79958, "modified": "2023-06-06"}, {"cve": "CVE-2020-26982", "epss": 0.00367, "percentile": 0.68469, "modified": "2023-06-06"}, {"cve": "CVE-2020-26983", "epss": 0.00367, "percentile": 0.68469, "modified": "2023-06-06"}, {"cve": "CVE-2020-26984", "epss": 0.00367, "percentile": 0.68469, "modified": "2023-06-06"}, {"cve": "CVE-2020-26985", "epss": 0.01414, "percentile": 0.84567, "modified": "2023-06-06"}, {"cve": "CVE-2020-26986", "epss": 0.00531, "percentile": 0.73782, "modified": "2023-06-06"}, {"cve": "CVE-2020-26987", "epss": 0.01414, "percentile": 0.84567, "modified": "2023-06-06"}, {"cve": "CVE-2020-26988", "epss": 0.00367, "percentile": 0.68469, "modified": "2023-06-06"}, {"cve": "CVE-2020-26989", "epss": 0.00205, "percentile": 0.57117, "modified": "2023-06-06"}, {"cve": "CVE-2020-26990", "epss": 0.00739, "percentile": 0.78186, "modified": "2023-06-06"}, {"cve": "CVE-2020-26991", "epss": 0.01269, "percentile": 0.83708, "modified": "2023-06-06"}, {"cve": "CVE-2020-26992", "epss": 0.00064, "percentile": 0.26321, "modified": "2023-06-06"}, {"cve": "CVE-2020-26993", "epss": 0.00064, "percentile": 0.26321, "modified": "2023-06-06"}, {"cve": "CVE-2020-26994", "epss": 0.00225, "percentile": 0.59486, "modified": "2023-06-06"}, {"cve": "CVE-2020-26995", "epss": 0.01579, "percentile": 0.85414, "modified": "2023-06-06"}, {"cve": "CVE-2020-26996", "epss": 0.00307, "percentile": 0.65492, "modified": "2023-06-06"}, {"cve": "CVE-2020-28383", "epss": 0.00223, "percentile": 0.59321, "modified": "2023-06-06"}], "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 6.8}, "severity": "MEDIUM", "exploitabilityScore": 8.6, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}, "href": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-012-03", "reporter": "Industrial Control Systems Cyber Emergency Response Team", "references": ["https://www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-21-012-03&title=Siemens%20JT2Go%20and%20Teamcenter%20Visualization%20%28Update%20B%29", "https://twitter.com/intent/tweet?text=Siemens%20JT2Go%20and%20Teamcenter%20Visualization%20%28Update%20B%29+https://www.cisa.gov/news-events/ics-advisories/icsa-21-012-03", "https://www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-21-012-03", "mailto:?subject=Siemens%20JT2Go%20and%20Teamcenter%20Visualization%20%28Update%20B%29&body=https://www.cisa.gov/news-events/ics-advisories/icsa-21-012-03", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26989", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26990", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26383", "https://www.siemens.com/cert/advisories", "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-06", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26991", "https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf", "https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04", "https://cwe.mitre.org/data/definitions/843.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26980", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/611.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26981", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L", "https://cwe.mitre.org/data/definitions/787.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26982", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/787.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26983", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/787.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26984", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/122.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26985", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/122.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26986", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/122.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26987", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/787.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26988", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/121.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26992", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/121.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26993", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/122.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26994", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/787.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26995", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://cwe.mitre.org/data/definitions/125.html", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26996", "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "https://support.sw.siemens.com/", "https://support.sw.siemens.com/", "https://www.siemens.com/Industrialsecurity", "https://www.siemens.com/cert/advisories", "https://www.siemens.com/cert/advisories", "https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf", "https://www.siemens.com/cert/operational-guidelines%20industrial-security", "https://www.siemens.com/Industrialsecurity", "https://us-cert.cisa.gov/sites/default/files/publications/emailscams_0905.pdf", "https://us-cert.cisa.gov/ncas/tips/ST04-014", "https://us-cert.cisa.gov/ics/recommended-practices", "https://us-cert.cisa.gov/ics", "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf", "https://us-cert.cisa.gov/ics", "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B", "https://www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-21-012-03", "https://www.facebook.com/CISA", "https://twitter.com/CISAgov", "https://www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency", "https://www.youtube.com/@cisagov", "https://www.instagram.com/cisagov", "https://www.dhs.gov/accessibility", "https://www.dhs.gov/performance-financial-reports", "https://www.dhs.gov", "https://www.dhs.gov/foia", "https://www.oig.dhs.gov/", "https://public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138", "https://www.whitehouse.gov/", "https://www.usa.gov/"], "cvelist": ["CVE-2020-26383", "CVE-2020-26980", "CVE-2020-26981", "CVE-2020-26982", "CVE-2020-26983", "CVE-2020-26984", "CVE-2020-26985", "CVE-2020-26986", "CVE-2020-26987", "CVE-2020-26988", "CVE-2020-26989", "CVE-2020-26990", "CVE-2020-26991", "CVE-2020-26992", "CVE-2020-26993", "CVE-2020-26994", "CVE-2020-26995", "CVE-2020-26996", "CVE-2020-28383"], "immutableFields": [], "lastseen": "2023-09-10T00:32:34", "viewCount": 364, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2020-26383", "CVE-2020-26980", "CVE-2020-26981", "CVE-2020-26982", "CVE-2020-26983", "CVE-2020-26984", "CVE-2020-26985", "CVE-2020-26986", "CVE-2020-26987", "CVE-2020-26988", "CVE-2020-26989", "CVE-2020-26990", "CVE-2020-26991", "CVE-2020-26992", "CVE-2020-26993", "CVE-2020-26994", "CVE-2020-26995", "CVE-2020-26996", "CVE-2020-28383"]}, {"type": "ics", "idList": ["ICSA-21-012-04", "ICSA-21-040-06", "ICSA-21-147-04"]}, {"type": "nessus", "idList": ["SIEMENS_JT2GO_SSA-622830.NASL", "SIEMENS_JT2GO_SSA-663999.NASL", "SIEMENS_JT2GO_SSA-695540.NASL"]}, {"type": "zdi", "idList": ["ZDI-21-046", "ZDI-21-047", "ZDI-21-048", "ZDI-21-049", "ZDI-21-050", "ZDI-21-051", "ZDI-21-052", "ZDI-21-053", "ZDI-21-054", "ZDI-21-055", "ZDI-21-056", "ZDI-21-057", "ZDI-21-058", "ZDI-21-059", "ZDI-21-060", "ZDI-21-061", "ZDI-21-062", "ZDI-21-073", "ZDI-21-241", "ZDI-21-242"]}]}, "score": {"value": 8.7, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2020-26980", "CVE-2020-26981", "CVE-2020-26982", "CVE-2020-26983", "CVE-2020-26984", "CVE-2020-26985", "CVE-2020-26986", "CVE-2020-26987", "CVE-2020-26988", "CVE-2020-26989", "CVE-2020-26990", "CVE-2020-26991", "CVE-2020-26992", "CVE-2020-26993", "CVE-2020-26994", "CVE-2020-26995", "CVE-2020-26996", "CVE-2020-28383"]}, {"type": "ics", "idList": ["ICSA-13-011-01", "ICSA-13-149-01"]}, {"type": "nessus", "idList": ["SIEMENS_JT2GO_SSA-622830.NASL"]}, {"type": "threatpost", "idList": ["THREATPOST:134A95E2E7432DE5E6F46316E469C55B", "THREATPOST:75B109B5B464EBEE349E710C31FA89E1"]}, {"type": "zdi", "idList": ["ZDI-21-046", "ZDI-21-047", "ZDI-21-048", "ZDI-21-049", "ZDI-21-050", "ZDI-21-051", "ZDI-21-052", "ZDI-21-053", "ZDI-21-054", "ZDI-21-055", "ZDI-21-056", "ZDI-21-057", "ZDI-21-058", "ZDI-21-059", "ZDI-21-060", "ZDI-21-061", "ZDI-21-062", "ZDI-21-073"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2020-26980", "epss": 0.00374, "percentile": 0.68648, "modified": "2023-05-07"}, {"cve": "CVE-2020-26981", "epss": 0.00859, "percentile": 0.79917, "modified": "2023-05-07"}, {"cve": "CVE-2020-26982", "epss": 0.00367, "percentile": 0.68343, "modified": "2023-05-07"}, {"cve": "CVE-2020-26983", "epss": 0.00367, "percentile": 0.68343, "modified": "2023-05-07"}, {"cve": "CVE-2020-26984", "epss": 0.00367, "percentile": 0.68343, "modified": "2023-05-07"}, {"cve": "CVE-2020-26985", "epss": 0.01414, "percentile": 0.84491, "modified": "2023-05-07"}, {"cve": "CVE-2020-26986", "epss": 0.00375, "percentile": 0.68672, "modified": "2023-05-07"}, {"cve": "CVE-2020-26987", "epss": 0.01414, "percentile": 0.84491, "modified": "2023-05-07"}, {"cve": "CVE-2020-26988", "epss": 0.00367, "percentile": 0.68343, "modified": "2023-05-07"}, {"cve": "CVE-2020-26989", "epss": 0.00158, "percentile": 0.50859, "modified": "2023-05-07"}, {"cve": "CVE-2020-26990", "epss": 0.00739, "percentile": 0.78121, "modified": "2023-05-07"}, {"cve": "CVE-2020-26991", "epss": 0.01269, "percentile": 0.83615, "modified": "2023-05-07"}, {"cve": "CVE-2020-26992", "epss": 0.00064, "percentile": 0.26191, "modified": "2023-05-07"}, {"cve": "CVE-2020-26993", "epss": 0.00064, "percentile": 0.26191, "modified": "2023-05-07"}, {"cve": "CVE-2020-26994", "epss": 0.00225, "percentile": 0.59318, "modified": "2023-05-07"}, {"cve": "CVE-2020-26995", "epss": 0.01579, "percentile": 0.85357, "modified": "2023-05-07"}, {"cve": "CVE-2020-26996", "epss": 0.00307, "percentile": 0.65371, "modified": "2023-05-07"}, {"cve": "CVE-2020-28383", "epss": 0.00173, "percentile": 0.52914, "modified": "2023-05-07"}], "vulnersScore": 8.7}, "_state": {"dependencies": 1694306104, "score": 1694306104, "epss": 0}, "_internal": {"score_hash": "f9cb0b45fbae64d2a006b856fb3bb764"}}

{"nessus": [{"lastseen": "2023-05-18T15:22:37", "description": "The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0. It is, therefore, affected by multiple vulnerabilities, including the following:\n\n - A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing JT files. A crafted JT file could trigger a type confusion condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (CVE-2020-26980)\n\n - A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing CG4 and CGM files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n (CVE-2020-26982)\n\n - A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing PDF files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (CVE-2020-26983)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-01-29T00:00:00", "type": "nessus", "title": "Siemens JT2Go < 13.1.0 Multiple Vulnerabilities (SSA-622830)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-26980", "CVE-2020-26981", "CVE-2020-26982", "CVE-2020-26983", "CVE-2020-26984", "CVE-2020-26985", "CVE-2020-26986", "CVE-2020-26987", "CVE-2020-26988", "CVE-2020-26992", "CVE-2020-26993", "CVE-2020-26994", "CVE-2020-26995", "CVE-2020-26996", "CVE-2020-28383"], "modified": "2022-05-11T00:00:00", "cpe": ["cpe:/a:siemens:jt2go"], "id": "SIEMENS_JT2GO_SSA-622830.NASL", "href": "https://www.tenable.com/plugins/nessus/145549", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(145549);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/11\");\n\n script_cve_id(\n \"CVE-2020-26980\",\n \"CVE-2020-26981\",\n \"CVE-2020-26982\",\n \"CVE-2020-26983\",\n \"CVE-2020-26984\",\n \"CVE-2020-26985\",\n \"CVE-2020-26986\",\n \"CVE-2020-26987\",\n \"CVE-2020-26988\",\n \"CVE-2020-26992\",\n \"CVE-2020-26993\",\n \"CVE-2020-26994\",\n \"CVE-2020-26995\",\n \"CVE-2020-26996\",\n \"CVE-2020-28383\"\n );\n\n script_name(english:\"Siemens JT2Go < 13.1.0 Multiple Vulnerabilities (SSA-622830)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains an application affected by multiple vulnerabilities\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0. It is, therefore, affected by\nmultiple vulnerabilities, including the following:\n\n - A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All\n versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing JT\n files. A crafted JT file could trigger a type confusion condition. An attacker could leverage this\n vulnerability to execute code in the context of the current process. (CVE-2020-26980)\n\n - A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All\n versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing CG4\n and CGM files. This could result in an out of bounds write past the end of an allocated structure. An\n attacker could leverage this vulnerability to execute code in the context of the current process.\n (CVE-2020-26982)\n\n - A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All\n versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing PDF\n files. This could result in an out of bounds write past the end of an allocated structure. An attacker\n could leverage this vulnerability to execute code in the context of the current process. (CVE-2020-26983)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version \nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update JT2Go to version 13.1.0 (File version 13.1.0.20328)\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-28383\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-26996\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/01/29\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:siemens:jt2go\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"siemens_jt2go_win_installed.nbin\");\n script_require_keys(\"installed_sw/Siemens JT2Go\");\n\n exit(0);\n}\n\n\ninclude('vcf.inc');\n\nvar app_info = vcf::get_app_info(app:'Siemens JT2Go', win_local:TRUE);\n\nvar constraints = [\n { 'fixed_version': '13.1.0.20328', 'fixed_display':'13.1.0 (File version 13.1.0.20328)' }\n];\n\nvcf::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_WARNING\n);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-06-18T15:05:29", "description": "The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0.1. It is, therefore, affected by multiple vulnerabilities, including the following:\n\n - A vulnerability has been identified in JT2Go. Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.\n (CVE-2020-26989)\n\n - A vulnerability has been identified in JT2Go. Affected applications lack proper validation of user-supplied data when parsing ASM files. A crafted ASM file can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.\n (CVE-2020-26990)\n\n - A vulnerability has been identified in JT2Go. Affected applications lack proper validation of user-supplied data when parsing ASM files. This could lead to pointer dereferences of a value obtained from untrusted source. An attacker could leverage this vulnerability to execute code in the context of the current process. (CVE-2020-26991)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-05-07T00:00:00", "type": "nessus", "title": "Siemens JT2Go < 13.1.0.1 Multiple Vulnerabilities (SSA-663999)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-26989", "CVE-2020-26990", "CVE-2020-26991", "CVE-2020-26998", "CVE-2020-26999", "CVE-2020-27000", "CVE-2020-27001", "CVE-2020-27002", "CVE-2020-27003", "CVE-2020-27004", "CVE-2020-27005", "CVE-2020-27006", "CVE-2020-27007", "CVE-2020-27008", "CVE-2020-28394", "CVE-2021-25173", "CVE-2021-25174", "CVE-2021-25175", "CVE-2021-25176", "CVE-2021-25177", "CVE-2021-25178"], "modified": "2022-05-10T00:00:00", "cpe": ["cpe:/a:siemens:jt2go"], "id": "SIEMENS_JT2GO_SSA-663999.NASL", "href": "https://www.tenable.com/plugins/nessus/149326", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(149326);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/10\");\n\n script_cve_id(\n \"CVE-2020-26989\",\n \"CVE-2020-26990\",\n \"CVE-2020-26991\",\n \"CVE-2020-26998\",\n \"CVE-2020-26999\",\n \"CVE-2020-27000\",\n \"CVE-2020-27001\",\n \"CVE-2020-27002\",\n \"CVE-2020-27003\",\n \"CVE-2020-27004\",\n \"CVE-2020-27005\",\n \"CVE-2020-27006\",\n \"CVE-2020-27007\",\n \"CVE-2020-27008\",\n \"CVE-2020-28394\",\n \"CVE-2021-25173\",\n \"CVE-2021-25174\",\n \"CVE-2021-25175\",\n \"CVE-2021-25176\",\n \"CVE-2021-25177\",\n \"CVE-2021-25178\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0049-S\");\n script_xref(name:\"IAVA\", value:\"2021-A-0258-S\");\n\n script_name(english:\"Siemens JT2Go < 13.1.0.1 Multiple Vulnerabilities (SSA-663999)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains an application affected by multiple vulnerabilities\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0.1. It is, therefore, affected by\nmultiple vulnerabilities, including the following:\n\n - A vulnerability has been identified in JT2Go. Affected applications lack proper validation of\n user-supplied data when parsing of PAR files. This could result in a stack based buffer overflow. An\n attacker could leverage this vulnerability to execute code in the context of the current process.\n (CVE-2020-26989)\n\n - A vulnerability has been identified in JT2Go. Affected applications lack proper validation of\n user-supplied data when parsing ASM files. A crafted ASM file can trigger a type confusion condition. An\n attacker can leverage this vulnerability to execute code in the context of the current process.\n (CVE-2020-26990)\n\n - A vulnerability has been identified in JT2Go. Affected applications lack proper validation of\n user-supplied data when parsing ASM files. This could lead to pointer dereferences of a value obtained\n from untrusted source. An attacker could leverage this vulnerability to execute code in the context of the\n current process. (CVE-2020-26991)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version \nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update JT2Go to version 13.1.0.1 (File version 13.1.0.21004)\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-25178\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-26991\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/05/07\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:siemens:jt2go\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"siemens_jt2go_win_installed.nbin\");\n script_require_keys(\"installed_sw/Siemens JT2Go\");\n\n exit(0);\n}\n\n\ninclude('vcf.inc');\n\nvar app_info = vcf::get_app_info(app:'Siemens JT2Go', win_local:TRUE);\n\nvar constraints = [\n { 'fixed_version': '13.1.0.21004', 'fixed_display':'13.1.0.1 (File version 13.1.0.21004)' }\n];\n\nvcf::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_WARNING\n);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-07-23T15:19:52", "description": "The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0.2. It is, therefore, affected by multiple vulnerabilities, including the following:\n\n - Affected applications lack proper validation of user-supplied data when parsing ASM files. This could lead to pointer dereferences of a value obtained from untrusted source. An attacker could leverage this vulnerability to execute code in the context of the current process. (CVE-2020-26991)\n\n - Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information. (CVE-2020-26999)\n\n - Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (CVE-2020-27001)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2021-06-02T00:00:00", "type": "nessus", "title": "Siemens JT2Go < 13.1.0.2 Multiple Vulnerabilities (SSA-695540)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2020-26991", "CVE-2020-26998", "CVE-2020-26999", "CVE-2020-27001", "CVE-2020-27002"], "modified": "2021-06-23T00:00:00", "cpe": ["cpe:/a:siemens:jt2go"], "id": "SIEMENS_JT2GO_SSA-695540.NASL", "href": "https://www.tenable.com/plugins/nessus/150140", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(150140);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/06/23\");\n\n script_cve_id(\n \"CVE-2020-26991\",\n \"CVE-2020-26998\",\n \"CVE-2020-26999\",\n \"CVE-2020-27001\",\n \"CVE-2020-27002\"\n );\n script_xref(name:\"IAVA\", value:\"2021-A-0258-S\");\n\n script_name(english:\"Siemens JT2Go < 13.1.0.2 Multiple Vulnerabilities (SSA-695540)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Windows host contains an application affected by multiple vulnerabilities\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0.2. It is, therefore, affected by\nmultiple vulnerabilities, including the following:\n\n - Affected applications lack proper validation of user-supplied data when parsing ASM files. This could\n lead to pointer dereferences of a value obtained from untrusted source. An attacker could leverage\n this vulnerability to execute code in the context of the current process. (CVE-2020-26991)\n\n - Affected applications lack proper validation of user-supplied data when parsing of PAR files. This\n could result in a memory access past the end of an allocated buffer. An attacker could leverage this\n vulnerability to leak information. (CVE-2020-26999)\n\n - Affected applications lack proper validation of user-supplied data when parsing of PAR files. This\n could result in a stack based buffer overflow. An attacker could leverage this vulnerability to execute\n code in the context of the current process. (CVE-2020-27001)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version \nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update JT2Go to version 13.1.0.2 (File version 13.1.0.21083)\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-26991\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/01/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/01/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/06/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:siemens:jt2go\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"siemens_jt2go_win_installed.nbin\");\n script_require_keys(\"installed_sw/Siemens JT2Go\");\n\n exit(0);\n}\n\n\ninclude('vcf.inc');\n\nvar app_info = vcf::get_app_info(app:'Siemens JT2Go', win_local:TRUE);\n\nvar constraints = [\n { 'fixed_version': '13.1.0.21083', 'fixed_display':'13.1.0.2 (File version 13.1.0.21083)' }\n];\n\nvcf::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_WARNING\n);\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "zdi": [{"lastseen": "2023-06-06T17:46:59", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of RGB and SGI files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go RGB and SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26985"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-056", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-056/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:46:53", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Solid Edge Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PAR files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-19T00:00:00", "type": "zdi", "title": "Siemens Solid Edge Viewer PAR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28383"], "modified": "2021-01-19T00:00:00", "id": "ZDI-21-073", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-073/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:00", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26983"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-054", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-054/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:02", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PAR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go PAR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26989"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-050", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-050/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:46:58", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TGA files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go TGA File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26987"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-059", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-059/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:46:59", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of RGB and SGI files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go RGB and SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26985"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-058", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-058/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:46:57", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TGA files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go TGA File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26987"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-061", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-061/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:00", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ASM files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-15T00:00:00", "type": "zdi", "title": "Siemens JT2Go ASM File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26991"], "modified": "2021-06-08T00:00:00", "id": "ZDI-21-053", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-053/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:00", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ASM files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go ASM File Parsing Type Confusion Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26990"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-055", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-055/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:00", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go JT File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26984"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-051", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-051/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:01", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CG4 and CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go CG4 and CGM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26982"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-052", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-052/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:03", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go JT File Parsing Type Confusion Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26980"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-046", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-046/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:45:48", "description": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SGI files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-02-24T00:00:00", "type": "zdi", "title": "Siemens JT2Go SGI File Parsing Use-After-Free Information Disclosure Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26995"], "modified": "2021-02-24T00:00:00", "id": "ZDI-21-242", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-242/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:46:58", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go JT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26986"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-057", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-057/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:02", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PAR files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go PAR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28383"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-047", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-047/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:45:49", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PCX files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-02-24T00:00:00", "type": "zdi", "title": "Siemens JT2Go PCX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26995"], "modified": "2021-02-24T00:00:00", "id": "ZDI-21-241", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-241/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:46:58", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SGI and RGB files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go SGI and RGB File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26995"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-060", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-060/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:46:57", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CG4 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go CG4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26996"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-062", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-062/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:02", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PAR files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go PAR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26988"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-049", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-049/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-06T17:47:02", "description": "This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PLMXML files. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2021-01-14T00:00:00", "type": "zdi", "title": "Siemens JT2Go PLMXML File Parsing XML External Entity Processing Information Disclosure Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26981"], "modified": "2021-01-14T00:00:00", "id": "ZDI-21-048", "href": "https://www.zerodayinitiative.com/advisories/ZDI-21-048/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2023-06-06T14:44:31", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing PAR files. This can result in an out of bounds write past the memory location that is a read only image address. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11885)", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-28383", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28383"], "modified": "2022-10-12T16:45:00", "cpe": ["cpe:/a:siemens:solid_edge:se2021", "cpe:/a:siemens:solid_edge:se2020"], "id": "CVE-2020-28383", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28383", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack9:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack3:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack6:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:-:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack11:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack1:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack10:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack8:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack4:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack5:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack7:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack2:*:*:*:*:*:*"]}, {"lastseen": "2023-06-06T14:41:53", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing CGM files. This could lead to a stack based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26992", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26992"], "modified": "2021-02-23T00:11:00", "cpe": [], "id": "CVE-2020-26992", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26992", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing ASM files. A crafted ASM file could trigger a type confusion condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11897)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26990", "cwe": ["CWE-843"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26990"], "modified": "2022-10-06T19:39:00", "cpe": [], "id": "CVE-2020-26990", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26990", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of RGB and SGI files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11986, ZDI-CAN-11994)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26985", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26985"], "modified": "2021-02-22T20:30:00", "cpe": [], "id": "CVE-2020-26985", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26985", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of TGA files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12016, ZDI-CAN-12017)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26987", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26987"], "modified": "2021-02-22T19:53:00", "cpe": [], "id": "CVE-2020-26987", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26987", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing PDF files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11900)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26983", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26983"], "modified": "2021-02-22T21:52:00", "cpe": [], "id": "CVE-2020-26983", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26983", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11892)", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26989", "cwe": ["CWE-121"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26989"], "modified": "2021-07-23T19:51:00", "cpe": ["cpe:/a:siemens:solid_edge:se2021"], "id": "CVE-2020-26989", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26989", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*", "cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*"]}, {"lastseen": "2023-06-06T14:41:50", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of CG4 files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12027)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26996", "cwe": ["CWE-125"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26996"], "modified": "2021-02-22T21:52:00", "cpe": [], "id": "CVE-2020-26996", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26996", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:51", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing CGM files. This could lead to a stack based buffer overflow while trying to copy to a buffer in the font index handling function. An attacker could leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26993", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26993"], "modified": "2021-02-22T23:57:00", "cpe": [], "id": "CVE-2020-26993", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26993", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of JT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11972)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26984", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26984"], "modified": "2021-02-22T21:30:00", "cpe": [], "id": "CVE-2020-26984", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26984", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing JT files. A crafted JT file could trigger a type confusion condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11881)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26980", "cwe": ["CWE-843"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26980"], "modified": "2021-02-22T19:43:00", "cpe": [], "id": "CVE-2020-26980", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26980", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11891)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26988", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26988"], "modified": "2021-02-22T19:52:00", "cpe": [], "id": "CVE-2020-26988", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26988", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:48", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of PCX files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26994", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26994"], "modified": "2021-02-22T21:55:00", "cpe": [], "id": "CVE-2020-26994", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26994", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of JT files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12014)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26986", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26986"], "modified": "2021-02-22T19:53:00", "cpe": [], "id": "CVE-2020-26986", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26986", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:50", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing of SGI and RGB files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11992)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26995", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26995"], "modified": "2021-03-05T19:19:00", "cpe": [], "id": "CVE-2020-26995", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26995", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:46", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing CG4 and CGM files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11898)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26982", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26982"], "modified": "2021-02-23T00:15:00", "cpe": [], "id": "CVE-2020-26982", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26982", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:48", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2). Affected applications lack proper validation of user-supplied data when parsing ASM files. This could lead to pointer dereferences of a value obtained from untrusted source. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11899)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26991", "cwe": ["CWE-822"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26991"], "modified": "2022-10-06T19:42:00", "cpe": [], "id": "CVE-2020-26991", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26991", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-06-06T14:41:47", "description": "A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). When opening a specially crafted xml file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11890)", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2021-01-12T21:15:00", "type": "cve", "title": "CVE-2020-26981", "cwe": ["CWE-611"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26981"], "modified": "2021-02-23T13:50:00", "cpe": [], "id": "CVE-2020-26981", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26981", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2022-12-02T23:10:48", "description": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none.", "cvss3": {}, "published": "2022-12-02T22:15:00", "type": "cve", "title": "CVE-2020-26383", "cwe": [], "bulletinFamily": "NVD", "cvss2": {}, "cvelist": ["CVE-2020-26383"], "modified": "2022-12-02T22:15:00", "cpe": [], "id": "CVE-2020-26383", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26383", "cvss": {"score": 0.0, "vector": "NONE"}, "cpe23": []}], "ics": [{"lastseen": "2023-09-10T01:47:28", "description": "## 1\\. EXECUTIVE SUMMARY\n\n * **CVSS v3 7.8**\n * **ATTENTION: **Low skill level to exploit\n * **Vendor: **Siemens\n * **Equipment:** Solid Edge\n * **Vulnerabilities:** Out-of-bounds Write, Stack-based Buffer Overflow\n\n## 2\\. RISK EVALUATION\n\nSuccessful exploitation of these vulnerabilities could allow arbitrary code execution on an affected system.\n\n## 3\\. TECHNICAL DETAILS\n\n### 3.1 AFFECTED PRODUCTS\n\nThe following versions of Solid Edge, a portfolio of software tools, are affected:\n\n * Solid Edge: All versions prior to SE2021MP2\n\n### 3.2 VULNERABILITY OVERVIEW\n\n#### 3.2.1 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nThe affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-28381](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28381>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 3.2.2 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nThe affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-28382](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28382>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 3.2.3 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nThe affected applications lack proper validation of user-supplied data when parsing PAR files. This can result in an out-of-bounds write past the memory location of a read only image address. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-28383](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28383>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 3.2.4 [STACK-BASED BUFFER OVERFLOW CWE-121](<https://cwe.mitre.org/data/definitions/121.html>)\n\nThe affected applications lack proper validation of user-supplied data when parsing PAR files. This could lead to a stack-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-28384](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28384>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 3.2.5 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nThe affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-28386](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28386>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 3.2.6 [STACK-BASED BUFFER OVERFLOW CWE-121](<https://cwe.mitre.org/data/definitions/121.html>)\n\nThe affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26989](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26989>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n### 3.3 BACKGROUND\n\n * **CRITICAL INFRASTRUCTURE SECTORS:** Critical Manufacturing\n * **COUNTRIES/AREAS DEPLOYED:** Worldwide\n * **COMPANY HEADQUARTERS LOCATION: **Germany\n\n### 3.4 RESEARCHER\n\nrgod, working with Trend Micro\u2019s Zero Day Initiative, reported these vulnerabilities to CISA.\n\n## 4\\. MITIGATIONS\n\nSiemens has published a [security advisory](<https://www.siemens.com/cert/advisories>) and released an update to Version SE2021MP2 or later for Solid Edge and recommends users [update to the latest version](<https://support.sw.siemens.com/>) (login required).\n\nSiemens has identified the following specific workarounds and mitigations users can apply to reduce risk:\n\n * Siemens recommends limiting opening of untrusted files from unknown sources in Solid Edge.\n * Applying a defense-in-depth concept can help to reduce the probability untrusted code is run on the system. Siemens recommends applying the [defense-in-depth](<https://www.siemens.com/industrialsecurity>) concept.\n\nAs a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to [Siemens\u2019 operational guidelines for Industrial Security](<https://www.siemens.com/cert/operational-guidelines-industrial-security>), and follow the recommendations in the product manual.\n\nAdditional information on Industrial Security by Siemens can be found at: <https://www.siemens.com/industrialsecurity>\n\nFor more information about this issue, please see Siemens security advisory [SSA-979834](<https://www.siemens.com/cert/advisories>)\n\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for [control systems security recommended practices](<https://us-cert.cisa.gov/ics/recommended-practices>) on the ICS webpage on [us-cert.cisa.gov](<https://us-cert.cisa.gov/ics>). Several recommended practices are available for reading and download, including [Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies](<https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf>).\n\nAdditional mitigation guidance and recommended practices are publicly available on the [ICS webpage on us-cert.cisa.gov](<https://us-cert.cisa.gov/ics>) in the Technical Information Paper, [ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies](<https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B>).\n\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.\n\nCISA also recommends users take the following measures to protect themselves from social engineering attacks:\n\n * Do not click web links or open unsolicited attachments in email messages.\n * Refer to [Recognizing and Avoiding Email Scams](<https://us-cert.cisa.gov/sites/default/files/publications/emailscams_0905.pdf>) for more information on avoiding email scams.\n * Refer to [Avoiding Social Engineering and Phishing Attacks](<https://us-cert.cisa.gov/ncas/tips/ST04-014>) for more information on social engineering attacks.\n\nNo known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.\n", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-01-12T12:00:00", "type": "ics", "title": "Siemens Solid Edge", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26989", "CVE-2020-28381", "CVE-2020-28382", "CVE-2020-28383", "CVE-2020-28384", "CVE-2020-28386"], "modified": "2021-01-12T12:00:00", "id": "ICSA-21-012-04", "href": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-012-04", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-09-10T00:33:34", "description": "## 1\\. EXECUTIVE SUMMARY\n\n * **CVSS v3 7.8**\n * **ATTENTION: **Low attack complexity\n * **Vendor: **Siemens\n * **Equipment: **JT2Go and Teamcenter Visualization\n * **Vulnerabilities: **Out-of-bounds Read, Improper Restriction of Operations within the Bounds of a Memory Buffer, Stack-based Buffer overflow, Out-of-Bounds Write, Type Confusion, Untrusted Pointer Dereference, Incorrect Type Conversion or Cast\n\n## 2\\. UPDATE INFORMATION\n\nThis updated advisory is a follow-up to the original advisory titled Siemens JT2Go and Teamcenter Visualization that was published February 9, 2021, to the ICS webpage on us-cert.cisa.gov.\n\n## 3\\. RISK EVALUATION\n\nSuccessful exploitation of these vulnerabilities could lead to arbitrary code execution.\n\n## 4\\. TECHNICAL DETAILS\n\n### 4.1 AFFECTED PRODUCTS\n\nThe following products are affected:\n\n * JT2Go: All versions prior to v13.1.0.1\n * Teamcenter Visualization: All versions prior to v13.1.0.1\n\n### 4.2 VULNERABILITY OVERVIEW\n\n**\\--------- Begin Update A Part 1 of 1 ---------**\n\n[CVE-2020-26998](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26998>), [CVE-2020-26999](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26999>), [CVE-2020-27001](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27001>), [CVE-2020-27002](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27002>), and [CVE-2020-26991](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26991>) were moved to [SSA-695540](<https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf>) and [ICSA-21-147-04](<https://us-cert.cisa.gov/ics/advisories/icsa-21-147-04>)\n\n#### 4.2.1 [STACK-BASED BUFFER OVERFLOW CWE-121](<https://cwe.mitre.org/data/definitions/121.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26989](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26989>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.2 [ACCESS OF RESOURCE USING INCOMPATIBLE TYPE (\u2018TYPE CONFUSION') CWE-843](<https://cwe.mitre.org/data/definitions/843.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing ASM files. A crafted ASM file can trigger a type of confusion condition. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26990](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26990>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.3 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PAR files. This can result in an out-of-bounds write past the memory location that is a read-only image address. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-28383](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28383>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.4 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nAn out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6. This could allow an attacker to cause a crash, potentially enabling a denial-of-service attack (crash, exit, or restart) or code execution.\n\n[CVE-2021-31784](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-31784>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n**\\--------- End Update A Part 1 of 1 ---------**\n\n#### 4.2.5 [IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119](<https://cwe.mitre.org/data/definitions/119.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing BMP files. This can result in a memory-corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-27000](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27000>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.6 [UNTRUSTED POINTER DEREFERENCE CWE-822](<https://cwe.mitre.org/data/definitions/822.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing TIFF files. This could lead to pointer dereferences of a value obtained from untrusted source. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-27003](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27003>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.7 [OUT-OF-BOUNDS READ CWE-125](<https://cwe.mitre.org/data/definitions/125.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing CGM files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process.\n\n[CVE-2020-27004](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27004>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.8 [OUT-OF-BOUNDS WRITE CWE-787](<https://cwe.mitre.org/data/definitions/787.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing TGA files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-27005](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27005>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.9 [IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119](<https://cwe.mitre.org/data/definitions/119.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PCT files. This could result in a memory-corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-27006](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27006>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.10 [OUT-OF-BOUNDS READ CWE-125](<https://cwe.mitre.org/data/definitions/125.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing HPG files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process.\n\n[CVE-2020-27007](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27007>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.11 [OUT-OF-BOUNDS READ CWE-125](<https://cwe.mitre.org/data/definitions/125.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PLT files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process.\n\n[CVE-2020-27008](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27008>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.12 [OUT-OF-BOUNDS READ CWE-125](<https://cwe.mitre.org/data/definitions/125.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing RAS files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process.\n\n[CVE-2020-28394](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28394>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.13 [STACK-BASED BUFFER OVERFLOW CWE-121](<https://cwe.mitre.org/data/definitions/121.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26989](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26989>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.14 [ACCESS OF RESOURCE USING INCOMPATIBLE TYPE (\u2018TYPE CONFUSION') CWE-843](<https://cwe.mitre.org/data/definitions/843.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing ASM files. A crafted ASM file can trigger a type-confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26990](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26990>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.15 [STACK-BASED BUFFER OVERFLOW CWE-121](<https://cwe.mitre.org/data/definitions/121.html>)\n\nAn issue was discovered in Open Design Alliance Drawings SDK before v2021.11. A stack-based buffer overflow vulnerability exists when the recover operation is run with malformed DXF and DWG files.\n\n[CVE-2021-25178](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25178>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.16 [ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843](<https://cwe.mitre.org/data/definitions/843.html>)\n\nAn issue was discovered in Open Design Alliance Drawings SDK before v2021.11. A type-confusion issue exists when rendering malformed DXF and DWG files.\n\n[CVE-2021-25177](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25177>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.17 [UNTRUSTED POINTER DEREFERENCE CWE-822](<https://cwe.mitre.org/data/definitions/822.html>)\n\nAn issue was discovered in Open Design Alliance Drawings SDK before v2021.11. A NULL pointer dereference exists when rendering malformed DXF and DWG files. This could allow attackers to cause a crash, potentially enabling a denial-of-service attack (crash, exit, or restart).\n\n[CVE-2021-25176](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25176>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.18 [ INCORRECT TYPE CONVERSION OR CAST CWE-704](<https://cwe.mitre.org/data/definitions/704.html>)\n\nAn issue was discovered in Open Design Alliance Drawings SDK before v2021.11. A type conversion issue exists when rendering malformed DXF and DWG files. This could allow attackers to cause a crash, potentially enabling a denial-of-service attack (crash, exit, or restart).\n\n[CVE-2021-25175](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25175>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.19 [IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119](<https://cwe.mitre.org/data/definitions/119.html>)\n\nAn issue was discovered in Open Design Alliance Drawings SDK before v2021.12. A memory corruption vulnerability exists when reading malformed DGN files. This could allow attackers to cause a crash, enabling a denial-of-service condition (crash, exit, or restart).\n\n[CVE-2021-25174](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25174>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 4.2.20 [MEMORY ALLOCATION WITH EXCESSIVE SIZE VALUE CWE-789](<https://cwe.mitre.org/data/definitions/789.html>)\n\nAn issue was discovered in Open Design Alliance Drawings SDK before v2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which could allow attackers to cause a crash, enabling a denial-of-service condition (crash, exit, or restart).\n\n[CVE-2021-25173](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25173>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n### 4.3 BACKGROUND\n\n * **CRITICAL INFRASTRUCTURE SECTORS: **Critical Manufacturing\n * **COUNTRIES/AREAS DEPLOYED:** Worldwide\n * **COMPANY HEADQUARTERS LOCATION: **Germany\n\n### 4.4 RESEARCHER\n\nMichael DePlante (@izobashi), Francis Provencher {PRL}, and rgod, working with Trend Micro\u2019s Zero Day Initiative, reported these vulnerabilities to CISA.\n\n## 5\\. MITIGATIONS\n\nSiemens recommends the following:\n\n * JT2Go: Update to [v13.1.0.1 or later](<https://support.sw.siemens.com/>) (login required).\n * Teamcenter Visualization: Update to [v13.1.0.1 or later](<https://support.sw.siemens.com/>) (login required).\n * Limiting the opening of untrusted files in systems where JT2Go or Teamcenter Visualization is installed.\n * Applying a [defense-in-depth](<https://www.siemens.com/Industrialsecurity>) concept can help to reduce the probability for an untrusted code to run on the system. \n * For additional information refer to [SSA-622830](<https://www.siemens.com/cert/advisories>) and [SSA-663999](<https://www.siemens.com/cert/advisories>)\n * For additional information concerning Open Design Alliance Drawings SDK issues refer to [Open Design Alliance\u2019s Security Advisories](<https://www.opendesign.com/security-advisories>).\n\nSiemens strongly recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to [Siemens\u2019 operational guidelines for Industrial Security](<https://www.siemens.com/cert/operational-guidelines%20industrial-security>) and follow the recommendations in the product manuals.\n\nAdditional information on industrial security by Siemens can be found at: <https://www.siemens.com/Industrialsecurity> \nCISA recommends users take the following measures to protect themselves from social engineering attacks:\n\n * Do not click web links or open unsolicited attachments in email messages.\n * Refer to [Recognizing and Avoiding Email Scams](<https://us-cert.cisa.gov/sites/default/files/publications/emailscams_0905.pdf>) for more information on avoiding email scams.\n * Refer to [Avoiding Social Engineering and Phishing Attacks](<https://us-cert.cisa.gov/ncas/tips/ST04-014>) for more information on social engineering attacks.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for [control systems security recommended practices](<https://us-cert.cisa.gov/ics/recommended-practices>) on the ICS webpage on [us-cert.cisa.gov](<https://us-cert.cisa.gov/ics>). Several recommended practices are available for reading and download, including [Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies](<https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf>).\n\nAdditional mitigation guidance and recommended practices are publicly available on the [ICS webpage on us-cert.cisa.gov](<https://us-cert.cisa.gov/ics>) in the Technical Information Paper, [ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies](<https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B>).\n\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.\n\nNo known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-05-27T12:00:00", "type": "ics", "title": "Siemens JT2Go and Teamcenter Visualization (Update A)", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26989", "CVE-2020-26990", "CVE-2020-26991", "CVE-2020-26998", "CVE-2020-26999", "CVE-2020-27000", "CVE-2020-27001", "CVE-2020-27002", "CVE-2020-27003", "CVE-2020-27004", "CVE-2020-27005", "CVE-2020-27006", "CVE-2020-27007", "CVE-2020-27008", "CVE-2020-28383", "CVE-2020-28394", "CVE-2021-25173", "CVE-2021-25174", "CVE-2021-25175", "CVE-2021-25176", "CVE-2021-25177", "CVE-2021-25178", "CVE-2021-31784"], "modified": "2021-05-27T12:00:00", "id": "ICSA-21-040-06", "href": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-040-06", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-09-10T00:34:33", "description": "## 1\\. EXECUTIVE SUMMARY\n\n * **CVSS v3 7.8**\n * **ATTENTION:** Low attack complexity\n * **Vendor:** Siemens\n * **Equipment:** JT2Go and Teamcenter Visualization\n * **Vulnerabilities:** Untrusted Pointer Dereference, Out-of-bounds Read, Stack-based Buffer Overflow\n\n## 2\\. RISK EVALUATION\n\nSuccessful exploitation of these vulnerabilities could lead to arbitrary code execution or information leakage.\n\n## 3\\. TECHNICAL DETAILS\n\n### 3.1 AFFECTED PRODUCTS\n\nThe following products are affected:\n\n * JT2Go: All versions prior to v13.1.0.2\n * Teamcenter Visualization: All versions prior to v13.1.0.2\n\n### 3.2 VULNERABILITY OVERVIEW\n\n#### 3.2.1 [OUT-OF-BOUNDS READ CWE-125](<https://cwe.mitre.org/data/definitions/125.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information.\n\n[CVE-2020-26998](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26998>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 3.2.2 [OUT-OF-BOUNDS READ CWE-125](<https://cwe.mitre.org/data/definitions/125.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information.\n\n[CVE-2020-26999](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26999>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 3.2.3 [STACK-BASED BUFFER OVERFLOW CWE-121](<https://cwe.mitre.org/data/definitions/121.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-27001](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27001>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n#### 3.2.4 [OUT-OF-BOUNDS READ CWE-125](<https://cwe.mitre.org/data/definitions/125.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing PAR files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process.\n\n[CVE-2020-27002](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27002>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>))\n\n#### 3.2.5 [UNTRUSTED POINTER DEREFERENCE CWE-822](<https://cwe.mitre.org/data/definitions/822.html>)\n\nAffected applications lack proper validation of user-supplied data when parsing ASM files. This could lead to pointer dereferences of a value obtained from an untrusted source. An attacker could leverage this vulnerability to execute code in the context of the current process.\n\n[CVE-2020-26991](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26991>) has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ([AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H>)).\n\n### 3.3 BACKGROUND\n\n * **CRITICAL INFRASTRUCTURE SECTORS: **Critical Manufacturing\n * **COUNTRIES/AREAS DEPLOYED: **Worldwide\n * **COMPANY HEADQUARTERS LOCATION: **Germany\n\n### 3.4 RESEARCHER\n\nMichael DePlante (@izobashi), Francis Provencher {PRL}, and rgod, working with Trend Micro\u2019s Zero Day Initiative reported four of these vulnerabilities to CISA. Carsten Eiram from Risk Based Security reported the fifth ([CVE-2020-26991](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26991>)) to Siemens.\n\n## 4\\. MITIGATIONS\n\nSiemens recommends the following:\n\n * JT2Go: Update to [v13.1.0.2](<https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html>) or later\n * Teamcenter Visualization: [Update to v13.1.0.2](<https://support.sw.siemens.com/>) or later (Login required)\n * Avoid opening untrusted files from unknown sources in JT2Go and Teamcenter Visualization\n\nAs a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to [Siemens\u2019 operational guidelines for industrial security](<https://www.siemens.com/cert/operational-guidelines-industrial-security>) and following the recommendations in the product manuals.\n\nAdditional information on industrial security by Siemens can be found at: <https://www.siemens.com/industrialsecurity>\n\nFor more information see Siemens Security Advisory [SSA-695540](<https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf>)\n\nCISA recommends users take the following measures to protect themselves from social engineering attacks:\n\n * Do not click web links or open unsolicited attachments in email messages.\n * Refer to [Recognizing and Avoiding Email Scams](<https://us-cert.cisa.gov/sites/default/files/publications/emailscams_0905.pdf>) for more information on avoiding email scams.\n * Refer to [Avoiding Social Engineering and Phishing Attacks](<https://us-cert.cisa.gov/ncas/tips/ST04-014>) for more information on social engineering attacks.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for [control systems security recommended practices](<https://us-cert.cisa.gov/ics/recommended-practices>) on the ICS webpage on [us-cert.cisa.gov](<https://us-cert.cisa.gov/ics>). Several recommended practices are available for reading and download, including [Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies](<https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf>).\n\nAdditional mitigation guidance and recommended practices are publicly available on the [ICS webpage on us-cert.cisa.gov](<https://us-cert.cisa.gov/ics>) in the Technical Information Paper, [ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies](<https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B>).\n\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.\n\nNo known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2021-05-27T12:00:00", "type": "ics", "title": "Siemens JT2Go and Teamcenter Visualization", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-26991", "CVE-2020-26998", "CVE-2020-26999", "CVE-2020-27001", "CVE-2020-27002"], "modified": "2021-05-27T12:00:00", "id": "ICSA-21-147-04", "href": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-147-04", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}