As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: Teamcenter Visualization, JT2Go
- Vulnerability: Out-of-bounds Read
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to execute code in the context of the current process.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following products of Siemens, are affected:
- Siemens JT2Go: Versions prior to v14.3.0.8
- Siemens Teamcenter Visualization V14.1: Versions prior to v14.1.0.14
- Siemens Teamcenter Visualization V14.2: Versions prior to v14.2.0.10
- Siemens Teamcenter Visualization V14.3: Versions prior to v14.3.0.8
- Siemens Teamcenter Visualization V2312: Versions prior to v2312.0002
3.2 Vulnerability Overview
3.2.1 OUT-OF-BOUNDS READ CWE-125
The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
CVE-2023-7066 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (This article has been indexed from All CISA Advisories