CVE-2021-44018
published 2022-02-09CVE-2021-44018: A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions <…
PriorityP342high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.69%
74.5th percentile
A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V13.1 (All versions < V13.1.0.9), Teamcenter Visualization V13.2 (All versions < V13.2.0.7), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll library is vulnerable to memory corruption condition while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15112)
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | jt2go | < 13.2.0.7 | 13.2.0.7 |
| siemens | jt2go | — | — |
| siemens | solid_edge | — | — |
| siemens | solid_edge | — | — |
| siemens | solid_edge_se2021 | — | — |
| siemens | solid_edge_se2022 | — | — |
| siemens | teamcenter_visualization | — | — |
| siemens | teamcenter_visualization | >= 13.2.0 < 13.2.0.7 | 13.2.0.7 |
| siemens | teamcenter_visualization | >= 13.3.0 < 13.3.0.1 | 13.3.0.1 |
| siemens | teamcenter_visualization_v13.1 | — | — |
| siemens | teamcenter_visualization_v13.2 | — | — |
| siemens | teamcenter_visualization_v13.3 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens Solid Edge, JT2Go, and Teamcenter Visualization (Update C)
cisa_ics·2022-04-14
Siemens Solid Edge, JT2Go, and Teamcenter Visualization (Update C)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Solid Edge, JT2Go, and Teamcenter Visualization (Update C)
Last RevisedJune 16, 2022
Alert CodeICSA-22-041-07
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low attack complexity
- Vendor: Siemens
- Equipment: Solid Edge, JT2Go, and Teamcenter Visualization
- Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Out-of-bounds Write, Heap-based Buffer Overflow, Out-of-bounds Read
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update ICSA-22-041-07 Siemens Solid Edge, JT2Go, and Teamcenter Visuali
GHSA
GHSA-qf66-r9gg-x4q3: A vulnerability has been identified in JT2Go (All versions), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1
ghsa_unreviewed·2022-02-10
CVE-2021-44018 [HIGH] CWE-119 GHSA-qf66-r9gg-x4q3: A vulnerability has been identified in JT2Go (All versions), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1
A vulnerability has been identified in JT2Go (All versions), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V12.4 (All versions), Teamcenter Visualization V13.1 (All versions), Teamcenter Visualization V13.2 (All versions), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll library is vulnerable to memory corruption condition while parsing specially crafted PAR files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15112)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-09
Published