CVE-2021-44015: Siemens JT2Go CGM File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Reference Links

• https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
• https://www.zerodayinitiative.com/advisories/ZDI-22-010/
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-350-10
• https://www.cisa.gov/news-events/ics-advisories/icsa-21-350-10 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-21-350-10

Frequently Asked Questions

• What is the vulnerability ID for this Siemens JT2Go vulnerability?

  The vulnerability ID for this Siemens JT2Go vulnerability is CVE-2021-44015.

• What is the title of this vulnerability?

  The title of this vulnerability is "Siemens JT2Go CGM File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability".

• What is the severity of CVE-2021-44015?

  The severity of CVE-2021-44015 is medium with a severity value of 5.5.

• How does the vulnerability CVE-2021-44015 allow attackers to disclose sensitive information?

  CVE-2021-44015 allows remote attackers to disclose sensitive information on affected installations of Siemens JT2Go through user interaction, such as visiting a malicious page or opening a malicious file.

• Is user interaction required to exploit the vulnerability CVE-2021-44015?

  Yes, user interaction is required to exploit the vulnerability CVE-2021-44015.

• Which Siemens products are affected by the vulnerability CVE-2021-44015?

  The Siemens products affected by the vulnerability CVE-2021-44015 are JT2Go and Siemens Teamcenter Visualization.

• What is the Common Weakness Enumeration (CWE) ID associated with CVE-2021-44015?

  The Common Weakness Enumeration (CWE) ID associated with CVE-2021-44015 is CWE-125.

• How can I fix the vulnerability CVE-2021-44015?

  To fix the vulnerability CVE-2021-44015, it is recommended to update to a version higher than 13.2.0.5 of Siemens JT2Go or Siemens Teamcenter Visualization.