ICSA-21-194-15_Siemens JT2Go and Teamcenter Visualization

An attacker could crash these applications or execute arbitrary code by sending a malicious JT file to a user. Since these tools are design and visualization applications used by engineering teams, successful exploitation could disrupt design workflows or allow an attacker to compromise engineering workstations that may have network access to control systems.

This affects engineering and design teams who use Siemens JT2Go or Teamcenter Visualization for 3D CAD viewing and design work. In a water or electric utility environment, this includes design engineering staff who may also have network access to control systems or supervisory workstations. Compromise of an engineering workstation could provide an attacker with a foothold into the corporate network or, if improperly segmented, into operational networks.

An attacker would create a malicious JT file (a 3D visualization format used in engineering) that triggers memory corruption when opened in JT2Go or Teamcenter Visualization. The attacker sends this file to an engineer via email or file sharing. When the engineer opens the file without suspecting it is malicious, the vulnerability is triggered, potentially allowing code execution on the engineering workstation.