Siemens Solid Edge, JT2Go, and Teamcenter Visualization

Plan Patch7.8ICS-CERT ICSA-22-041-07Feb 8, 2022

Attack VectorLocal

Auth RequiredNone

ComplexityLow

User InteractionRequired

Summary

Siemens Solid Edge, JT2Go, and Teamcenter Visualization contain multiple buffer overflow and out-of-bounds access vulnerabilities (CWE-119, CWE-787, CWE-122, CWE-125) in file parsing routines. If a user opens a specially crafted file (PDF, DXF, or PAR format) in any affected product, the application may crash or allow arbitrary code execution with the privileges of the user running the application. The vulnerability requires user interaction—an attacker must trick the user into opening a malicious file. Siemens has released patches for JT2Go and Teamcenter Visualization versions 12.4, 13.1, 13.2, and 13.3. Patches for Solid Edge SE2021 and SE2022 are not yet available, and Siemens recommends avoiding untrusted files as a compensating control.

What this means

What could happen

An attacker could trick a user into opening a malicious file that crashes the application or executes arbitrary code on the engineering workstation, potentially compromising the ability to design, review, or visualize plant models and configurations.

Who's at risk

Engineering and design personnel who use Siemens JT2Go (3D visualization tool), Solid Edge (CAD software), or Teamcenter Visualization (PLM visualization software) are affected. This impacts utilities and industrial facilities that rely on these tools for plant design documentation, process visualization, and engineering model review. Particularly relevant for engineering departments, control system integrators, and design teams.

How it could be exploited

An attacker sends or hosts a malicious file crafted as a PDF, DXF, or PAR file. When a user opens the file in an affected Siemens application (JT2Go, Solid Edge, or Teamcenter Visualization), the application parses the malformed file, triggering a buffer overflow or out-of-bounds memory access. This could crash the application or allow code execution in the context of the user running the application.

Prerequisites

User must open a malicious file in one of the affected applications
File must be crafted as PDF, DXF, or PAR format
No special privileges or network access required
Social engineering or phishing needed to deliver the malicious file

Local file parsing vulnerabilityUser interaction required (social engineering)Low attack complexityAffects engineering workstations used to manage plant designsSome products have no patch availableMultiple file formats exploitable (PDF, DXF, PAR)

Exploitability

Low exploit probability (EPSS 0.4%)

Affected products (8)

6 with fix2 EOL

ProductAffected VersionsFix Status

JT2Go<V13.2.0.713.2.0.7

Teamcenter Visualization V12.4<V12.4.0.1312.4.0.13

Teamcenter Visualization V13.1<V13.1.0.813.1.0.8

Teamcenter Visualization V13.1<V13.1.0.913.1.0.9

Teamcenter Visualization V13.2<V13.2.0.713.2.0.7

Teamcenter Visualization V13.3<V13.3.0.113.3.0.1

Solid Edge SE2021<SE2021MP9No fix (EOL)

Solid Edge SE2022<SE2022MP1No fix (EOL)

Remediation & Mitigation

0/10

Do now

0/1

WORKAROUNDDo not open untrusted files from unknown sources in affected applications

Schedule — requires maintenance window

0/7

Patching may require device reboot — plan for process interruption

JT2Go

HOTFIXUpdate JT2Go to version 13.2.0.7 or later

Teamcenter Visualization V12.4

HOTFIXUpdate Teamcenter Visualization V12.4 to version 12.4.0.13 or later

Teamcenter Visualization V13.1

HOTFIXUpdate Teamcenter Visualization V13.1 to version 13.1.0.9 or later

Teamcenter Visualization V13.2

HOTFIXUpdate Teamcenter Visualization V13.2 to version 13.2.0.7 or later

Teamcenter Visualization V13.3

HOTFIXUpdate Teamcenter Visualization V13.3 to version 13.3.0.1 or later

Solid Edge SE2021

HOTFIXUpdate Solid Edge SE2021 to SE2021MP9 or later

Solid Edge SE2022

HOTFIXUpdate Solid Edge SE2022 to SE2022MP1 or later

Mitigations - no patch available

0/2

The following products have reached End of Life with no planned fix: Solid Edge SE2021, Solid Edge SE2022. Apply the following compensating controls:

HARDENINGEducate users on recognizing phishing attempts and suspicious file deliveries

HARDENINGConfigure network access controls and implement defense-in-depth strategies per Siemens operational guidelines

CVEs (5)

CVE-2021-38405 CVE-2021-43336 CVE-2021-44000 CVE-2021-44016 CVE-2021-44018

View full CISA ICS-CERT advisory

↑↓ Navigate · Esc Close