Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-34326 (GCVE-0-2021-34326)
Vulnerability from cvelistv5
Published
2021-07-13 11:03
Modified
2024-08-04 00:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-122 - Heap-based Buffer Overflow
Summary
A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)
References
| URL | Tags | ||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Siemens | JT2Go |
Version: All versions < V13.2 |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:05:52.502Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "JT2Go",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V13.2"
}
]
},
{
"product": "Solid Edge SE2021",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All Versions \u003c SE2021MP5"
}
]
},
{
"product": "Teamcenter Visualization",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-19T10:06:59",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-34326",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "JT2Go",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V13.2"
}
]
}
},
{
"product_name": "Solid Edge SE2021",
"version": {
"version_data": [
{
"version_value": "All Versions \u003c SE2021MP5"
}
]
}
},
{
"product_name": "Teamcenter Visualization",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V13.2"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-122: Heap-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2021-34326",
"datePublished": "2021-07-13T11:03:42",
"dateReserved": "2021-06-08T00:00:00",
"dateUpdated": "2024-08-04T00:05:52.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2021-34326\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2021-07-13T11:15:12.927\",\"lastModified\":\"2024-11-21T06:10:10.323\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2), Solid Edge SE2021 (Todas las versiones anteriores a SE2021MP5), Teamcenter Visualization (Todas las versiones anteriores a V13.2). La biblioteca plmxmlAdapterSE70.dll de las aplicaciones afectadas no comprueba apropiadamente los datos suministrados por el usuario cuando se analizan los archivos PAR. Esto podr\u00eda resultar en una escritura fuera de l\u00edmites m\u00e1s all\u00e1 del b\u00fafer de fixed-length en la regi\u00f3n heap de la memoria. Un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual. (ZDI-CAN-13422)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.2.0\",\"matchCriteriaId\":\"CAFFF33E-9758-4C92-B2BF-2CF0E2EA6217\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"se2021\",\"matchCriteriaId\":\"576A303A-66CA-4694-AA54-9EB0137C24F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"39D237BD-EE55-4B40-ABC3-194C4BF7C6CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*\",\"matchCriteriaId\":\"49F5649A-349C-42C6-AFFF-CEE1ABC14E67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*\",\"matchCriteriaId\":\"756343AA-DB57-40F7-94FA-84BFCDEB6159\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*\",\"matchCriteriaId\":\"36B0DD28-653E-4069-AB5A-38F8EFEB36CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*\",\"matchCriteriaId\":\"82090774-D894-41C8-82F1-A48A8707E9BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.2.0\",\"matchCriteriaId\":\"6C391214-6E11-4196-BF69-5327069864D8\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-21-864/\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-21-864/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
}
}
CERTFR-2021-AVI-518
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Siemens | N/A | SIMIT Simulation Platform toutes les versions | ||
| Siemens | N/A | JT Utilities toutes les versions antérieures à 13.0.2.0 | ||
| Siemens | N/A | SICAM 230 toutes les versions | ||
| Siemens | N/A | Development/Evaluation Kits for PROFINET IO:DK Standard Ethernet Controller, EK-ERTEC 200 ET EK-ERTEC 200P toutes les versions | ||
| Siemens | N/A | TIM 1531 IRC (incl. SIPLUS NET variants) toutes les versions antérieures à 2.2 | ||
| Siemens | N/A | SINEC INS toutes les versions | ||
| Siemens | N/A | Les produits Teamcenter, pour plus d'informations veuillez-vous référer aux avis éditeurs | ||
| Siemens | N/A | Les produits SINAMICS, pour plus d'informations veuillez-vous référer aux avis éditeurs | ||
| Siemens | N/A | SIMOCODE proV PROFINET toutes les versions antérieures à 2.1.3 | ||
| Siemens | N/A | SOFTNET-IE PNIO toutes les versions | ||
| Siemens | N/A | PSS CAPE Protection Simulation Platform:CAPE 14 installé avant le 16 juin | ||
| Siemens | N/A | SINEMA Server V14.0.2.x | ||
| Siemens | N/A | Les produits SINUMERIK, pour plus d'informations veuillez-vous référer aux avis éditeurs | ||
| Siemens | N/A | JT2Go toutes les versions antérieures à 13.2 | ||
| Siemens | N/A | Les produits Mendix, pour plus d'informations veuillez-vous référer aux avis éditeurs | ||
| Siemens | N/A | SIMOCODE proV Ethernet/IP toutes les versions antérieures à 1.1.3 | ||
| Siemens | N/A | SINEC NMS:V1.0 SP1, V1.0 SP1 antérieures à version V1.0 SP2 | ||
| Siemens | N/A | Les produits SCALANCE, pour plus d'informations veuillez-vous référer aux avis éditeurs | ||
| Siemens | N/A | TIA Administrator toutes les versions | ||
| Siemens | N/A | RWG1.M12D toutes les versions | ||
| Siemens | N/A | Solid Edge SE2021 toutes les versions antérieures à SE2021MP5 | ||
| Siemens | N/A | RWG1.M12 toutes les versions | ||
| Siemens | N/A | Les produits SIMATIC, pour plus d'informations veuillez-vous référer aux avis éditeurs | ||
| Siemens | N/A | RWG1.M8 toutes les versions | ||
| Siemens | N/A | Les produits RUGGEDCOM, pour plus d'informations veuillez-vous référer aux avis éditeurs | ||
| Siemens | N/A | SINEC PNI toutes les versions | ||
| Siemens | N/A | SINEMA Remote Connect Server toutes les versions |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SIMIT Simulation Platform toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT Utilities toutes les versions ant\u00e9rieures \u00e0 13.0.2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SICAM 230 toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Development/Evaluation Kits for PROFINET IO:DK Standard Ethernet Controller, EK-ERTEC 200 ET EK-ERTEC 200P toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIM 1531 IRC (incl. SIPLUS NET variants) toutes les versions ant\u00e9rieures \u00e0 2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC INS toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Les produits Teamcenter, pour plus d\u0027informations veuillez-vous r\u00e9f\u00e9rer aux avis \u00e9diteurs",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Les produits SINAMICS, pour plus d\u0027informations veuillez-vous r\u00e9f\u00e9rer aux avis \u00e9diteurs",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOCODE proV PROFINET toutes les versions ant\u00e9rieures \u00e0 2.1.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SOFTNET-IE PNIO toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "PSS CAPE Protection Simulation Platform:CAPE 14 install\u00e9 avant le 16 juin",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Server V14.0.2.x",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Les produits SINUMERIK, pour plus d\u0027informations veuillez-vous r\u00e9f\u00e9rer aux avis \u00e9diteurs",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "JT2Go toutes les versions ant\u00e9rieures \u00e0 13.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Les produits Mendix, pour plus d\u0027informations veuillez-vous r\u00e9f\u00e9rer aux avis \u00e9diteurs",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SIMOCODE proV Ethernet/IP toutes les versions ant\u00e9rieures \u00e0 1.1.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC NMS:V1.0 SP1, V1.0 SP1 ant\u00e9rieures \u00e0 version V1.0 SP2",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Les produits SCALANCE, pour plus d\u0027informations veuillez-vous r\u00e9f\u00e9rer aux avis \u00e9diteurs",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "TIA Administrator toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RWG1.M12D toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Solid Edge SE2021 toutes les versions ant\u00e9rieures \u00e0 SE2021MP5",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RWG1.M12 toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Les produits SIMATIC, pour plus d\u0027informations veuillez-vous r\u00e9f\u00e9rer aux avis \u00e9diteurs",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "RWG1.M8 toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "Les produits RUGGEDCOM, pour plus d\u0027informations veuillez-vous r\u00e9f\u00e9rer aux avis \u00e9diteurs",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEC PNI toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
},
{
"description": "SINEMA Remote Connect Server toutes les versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Siemens",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-34320",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34320"
},
{
"name": "CVE-2021-34300",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34300"
},
{
"name": "CVE-2015-8011",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8011"
},
{
"name": "CVE-2021-34331",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34331"
},
{
"name": "CVE-2021-34297",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34297"
},
{
"name": "CVE-2021-31893",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31893"
},
{
"name": "CVE-2021-34324",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34324"
},
{
"name": "CVE-2021-34316",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34316"
},
{
"name": "CVE-2021-34292",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34292"
},
{
"name": "CVE-2021-33713",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33713"
},
{
"name": "CVE-2021-31892",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31892"
},
{
"name": "CVE-2021-34307",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34307"
},
{
"name": "CVE-2021-34310",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34310"
},
{
"name": "CVE-2021-34299",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34299"
},
{
"name": "CVE-2021-33715",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33715"
},
{
"name": "CVE-2021-34293",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34293"
},
{
"name": "CVE-2021-34302",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34302"
},
{
"name": "CVE-2021-34309",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34309"
},
{
"name": "CVE-2021-34301",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34301"
},
{
"name": "CVE-2021-34305",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34305"
},
{
"name": "CVE-2021-34313",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34313"
},
{
"name": "CVE-2021-33718",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33718"
},
{
"name": "CVE-2021-25671",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-25671"
},
{
"name": "CVE-2021-29998",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-29998"
},
{
"name": "CVE-2021-34330",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34330"
},
{
"name": "CVE-2021-34319",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34319"
},
{
"name": "CVE-2021-3449",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3449"
},
{
"name": "CVE-2021-31895",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31895"
},
{
"name": "CVE-2020-15782",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15782"
},
{
"name": "CVE-2021-34333",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34333"
},
{
"name": "CVE-2021-34308",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34308"
},
{
"name": "CVE-2021-34317",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34317"
},
{
"name": "CVE-2021-34321",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34321"
},
{
"name": "CVE-2021-20094",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20094"
},
{
"name": "CVE-2021-20093",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20093"
},
{
"name": "CVE-2021-34295",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34295"
},
{
"name": "CVE-2020-27827",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-27827"
},
{
"name": "CVE-2021-34328",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34328"
},
{
"name": "CVE-2021-34326",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34326"
},
{
"name": "CVE-2021-34318",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34318"
},
{
"name": "CVE-2021-34315",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34315"
},
{
"name": "CVE-2021-34327",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34327"
},
{
"name": "CVE-2020-26147",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26147"
},
{
"name": "CVE-2021-34322",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34322"
},
{
"name": "CVE-2021-34304",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34304"
},
{
"name": "CVE-2021-34314",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34314"
},
{
"name": "CVE-2020-28400",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28400"
},
{
"name": "CVE-2021-34311",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34311"
},
{
"name": "CVE-2021-33714",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33714"
},
{
"name": "CVE-2021-34296",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34296"
},
{
"name": "CVE-2021-31894",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31894"
},
{
"name": "CVE-2021-33710",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33710"
},
{
"name": "CVE-2021-34312",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34312"
},
{
"name": "CVE-2021-34329",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34329"
},
{
"name": "CVE-2021-34303",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34303"
},
{
"name": "CVE-2021-34306",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34306"
},
{
"name": "CVE-2021-34298",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34298"
},
{
"name": "CVE-2021-34291",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34291"
},
{
"name": "CVE-2021-33709",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33709"
},
{
"name": "CVE-2021-34325",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34325"
},
{
"name": "CVE-2021-34332",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34332"
},
{
"name": "CVE-2021-34323",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34323"
},
{
"name": "CVE-2021-34294",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34294"
},
{
"name": "CVE-2021-33711",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33711"
}
],
"initial_release_date": "2021-07-13T00:00:00",
"last_revision_date": "2021-07-13T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-518",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-07-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-641963 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-641963.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-729965 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-729965.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-560465 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-560465.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-772220 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-434536 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-209268 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-209268.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-173615 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-675303 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-675303.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-434535 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-599968 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-599968.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-622535 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-622535.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-941426 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-941426.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-661034 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661034.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-373591 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-373591.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-352521 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352521.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-913875 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-483182 du 13 juillet 2021",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
}
]
}
gsd-2021-34326
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-34326",
"description": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)",
"id": "GSD-2021-34326"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-34326"
],
"details": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)",
"id": "GSD-2021-34326",
"modified": "2023-12-13T01:23:14.101134Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-34326",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "JT2Go",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V13.2"
}
]
}
},
{
"product_name": "Solid Edge SE2021",
"version": {
"version_data": [
{
"version_value": "All Versions \u003c SE2021MP5"
}
]
}
},
{
"product_name": "Teamcenter Visualization",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V13.2"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-122: Heap-based Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "se2021",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-34326"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "N/A",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"name": "N/A",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-10-27T12:23Z",
"publishedDate": "2021-07-13T11:15Z"
}
}
}
ICSA-21-194-08
Vulnerability from csaf_cisa
Published
2021-07-13 00:00
Modified
2025-05-06 06:00
Summary
Siemens Solid Edge
Notes
Summary
Siemens has released version SE2021MP5 for Solid Edge to fix multiple heap based buffer overflow vulnerabilities that could be triggered when the application read files in PAR or ASM file formats. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to arbitrary code execution.
Siemens recommends to update to the latest version and to avoid opening of untrusted files from unknown sources.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting this vulnerability to CISA."
},
{
"organization": "Trend Micro Zero Day Initiative",
"summary": "coordinated disclosure"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"notes": [
{
"category": "summary",
"text": "Siemens has released version SE2021MP5 for Solid Edge to fix multiple heap based buffer overflow vulnerabilities that could be triggered when the application read files in PAR or ASM file formats. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to arbitrary code execution.\n\nSiemens recommends to update to the latest version and to avoid opening of untrusted files from unknown sources.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-173615.json"
},
{
"category": "self",
"summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-173615.txt"
},
{
"category": "self",
"summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-194-08 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-194-08.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-194-08 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-194-08"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens Solid Edge",
"tracking": {
"current_release_date": "2025-05-06T06:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-194-08",
"initial_release_date": "2021-07-13T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-07-13T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2025-05-06T06:00:00.000000Z",
"legacy_version": "Revision",
"number": "2",
"summary": "Revision - Fixing typos"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cSE2021MP5",
"product": {
"name": "Solid Edge SE2021",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "Solid Edge SE2021"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-34326",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-34326 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34326.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to SE2021MP5 or later version",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in Solid Edge",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-34326"
},
{
"cve": "CVE-2021-34327",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing ASM files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13423)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-34327 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34327.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to SE2021MP5 or later version",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in Solid Edge",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-34327"
},
{
"cve": "CVE-2021-34328",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13424)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-34328 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34328.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to SE2021MP5 or later version",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in Solid Edge",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-34328"
},
{
"cve": "CVE-2021-34329",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13427)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-34329 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34329.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to SE2021MP5 or later version",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in Solid Edge",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-34329"
}
]
}
icsa-21-194-08
Vulnerability from csaf_cisa
Published
2021-07-13 00:00
Modified
2025-05-06 06:00
Summary
Siemens Solid Edge
Notes
Summary
Siemens has released version SE2021MP5 for Solid Edge to fix multiple heap based buffer overflow vulnerabilities that could be triggered when the application read files in PAR or ASM file formats. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to arbitrary code execution.
Siemens recommends to update to the latest version and to avoid opening of untrusted files from unknown sources.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens ProductCERT",
"summary": "reporting this vulnerability to CISA."
},
{
"organization": "Trend Micro Zero Day Initiative",
"summary": "coordinated disclosure"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"notes": [
{
"category": "summary",
"text": "Siemens has released version SE2021MP5 for Solid Edge to fix multiple heap based buffer overflow vulnerabilities that could be triggered when the application read files in PAR or ASM file formats. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to arbitrary code execution.\n\nSiemens recommends to update to the latest version and to avoid opening of untrusted files from unknown sources.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
"title": "Terms of Use"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "other",
"text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
"title": "Advisory Conversion Disclaimer"
},
{
"category": "other",
"text": "Multiple",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "other",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-173615.json"
},
{
"category": "self",
"summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - TXT Version",
"url": "https://cert-portal.siemens.com/productcert/txt/ssa-173615.txt"
},
{
"category": "self",
"summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - PDF Version",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-194-08 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-194-08.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-194-08 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-194-08"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Siemens Solid Edge",
"tracking": {
"current_release_date": "2025-05-06T06:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-194-08",
"initial_release_date": "2021-07-13T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-07-13T00:00:00.000000Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2025-05-06T06:00:00.000000Z",
"legacy_version": "Revision",
"number": "2",
"summary": "Revision - Fixing typos"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cSE2021MP5",
"product": {
"name": "Solid Edge SE2021",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "Solid Edge SE2021"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-34326",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-34326 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34326.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to SE2021MP5 or later version",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in Solid Edge",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-34326"
},
{
"cve": "CVE-2021-34327",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing ASM files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13423)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-34327 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34327.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to SE2021MP5 or later version",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in Solid Edge",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-34327"
},
{
"cve": "CVE-2021-34328",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13424)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-34328 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34328.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to SE2021MP5 or later version",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in Solid Edge",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-34328"
},
{
"cve": "CVE-2021-34329",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13427)",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "CVE-2021-34329 Mitre 5.0 json",
"url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34329.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Update to SE2021MP5 or later version",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "mitigation",
"details": "Avoid to open untrusted files from unknown sources in Solid Edge",
"product_ids": [
"CSAFPID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "CVE-2021-34329"
}
]
}
icsa-21-194-15
Vulnerability from csaf_cisa
Published
2021-07-13 00:00
Modified
2021-07-13 00:00
Summary
ICSA-21-194-15_Siemens JT2Go and Teamcenter Visualization
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary
Brian Gorenc and Mat Powell of Trend Micro Zero Day Initiative; garmin and xina1i at SecZone; and Tran Van Khang - khangkito (VinCSS) working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.
Exploitability
No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.
{
"document": {
"acknowledgments": [
{
"names": [
"Brian Gorenc",
"Mat Powell"
],
"organization": "Trend Micro Zero Day Initiative",
"summary": "reporting these vulnerabilities to CISA"
},
{
"names": [
"garmin",
"xina1i"
],
"organization": "SecZone",
"summary": "reporting these vulnerabilities to CISA"
},
{
"names": [
"Tran Van Khang - khangkito"
],
"organization": "VinCSS",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "summary",
"text": "Brian Gorenc and Mat Powell of Trend Micro Zero Day Initiative; garmin and xina1i at SecZone; and Tran Van Khang - khangkito (VinCSS) working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.",
"title": "Summary"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "CISAservicedesk@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-21-194-15 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-194-15.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-194-15 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-194-15"
}
],
"title": "ICSA-21-194-15_Siemens JT2Go and Teamcenter Visualization",
"tracking": {
"current_release_date": "2021-07-13T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA USCert CSAF Generator",
"version": "1"
}
},
"id": "ICSA-21-194-15",
"initial_release_date": "2021-07-13T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-07-13T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-21-194-15 Siemens JT2Go and Teamcenter Visualization"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 13.2",
"product": {
"name": "Teamcenter Visualization: All versions prior to v13.2",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "Teamcenter Visualization"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 13.2",
"product": {
"name": "JT2Go: All versions prior to v13.2",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "JT2Go"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-34333",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in a double free of an allocated buffer that leads to a crash. An attacker could leverage this vulnerability to cause denial-of-service condition.CVE-2021-34333 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34333"
},
{
"cve": "CVE-2021-34332",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in an infinite loop condition that leads to a denial-of-service condition. An attacker could leverage this vulnerability to consume excessive resources.CVE-2021-34332 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34332"
},
{
"cve": "CVE-2021-34331",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34331 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34331"
},
{
"cve": "CVE-2021-34330",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34330 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34330"
},
{
"cve": "CVE-2021-34329",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34329 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34329"
},
{
"cve": "CVE-2021-34328",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34328 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34328"
},
{
"cve": "CVE-2021-34327",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing ASM files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34327 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34327"
},
{
"cve": "CVE-2021-34326",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34326 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34326"
},
{
"cve": "CVE-2021-34325",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. CVE-2021-34325 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34325"
},
{
"cve": "CVE-2021-34324",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34324 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34324"
},
{
"cve": "CVE-2021-34323",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34323 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34323"
},
{
"cve": "CVE-2021-34322",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The JPEG2K_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. CVE-2021-34322 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34322"
},
{
"cve": "CVE-2021-34321",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The VisDraw.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34321 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34321"
},
{
"cve": "CVE-2021-34320",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34320 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34320"
},
{
"cve": "CVE-2021-34319",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34319 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34319 "
},
{
"cve": "CVE-2021-34318",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing PCT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34318 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34318"
},
{
"cve": "CVE-2021-34317",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing PCX files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34317 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34317"
},
{
"cve": "CVE-2021-34316",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The DL180CoolType.dll library in affected applications lacks proper validation of user-supplied data when parsing PDF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34316 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34316"
},
{
"cve": "CVE-2021-34315",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34315 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34315"
},
{
"cve": "CVE-2021-34314",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34314 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34314 "
},
{
"cve": "CVE-2021-34313",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34313 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34313"
},
{
"cve": "CVE-2021-34312",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34312 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34312"
},
{
"cve": "CVE-2021-34311",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Mono_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34311 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34311"
},
{
"cve": "CVE-2021-34310",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34310 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34310"
},
{
"cve": "CVE-2021-34309",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34309 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34309"
},
{
"cve": "CVE-2021-34308",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34308 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34308"
},
{
"cve": "CVE-2021-34307",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34307 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34307"
},
{
"cve": "CVE-2021-34306",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34306 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34306"
},
{
"cve": "CVE-2021-34305",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34305 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34305"
},
{
"cve": "CVE-2021-34304",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34304 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34304"
},
{
"cve": "CVE-2021-34303",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34303 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34303"
},
{
"cve": "CVE-2021-34302",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34302 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34302"
},
{
"cve": "CVE-2021-34301",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34301 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34301"
},
{
"cve": "CVE-2021-34300",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34300 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34300"
},
{
"cve": "CVE-2021-34299",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34299 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34299"
},
{
"cve": "CVE-2021-34298",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34298 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34298"
},
{
"cve": "CVE-2021-34297",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34297 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34297"
},
{
"cve": "CVE-2021-34296",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34296 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34296"
},
{
"cve": "CVE-2021-34295",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34295 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34295"
},
{
"cve": "CVE-2021-34294",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34294 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34294"
},
{
"cve": "CVE-2021-34293",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34293 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34293"
},
{
"cve": "CVE-2021-34292",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34292 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34292"
},
{
"cve": "CVE-2021-34291",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34291 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34291"
}
]
}
ICSA-21-194-15
Vulnerability from csaf_cisa
Published
2021-07-13 00:00
Modified
2021-07-13 00:00
Summary
ICSA-21-194-15_Siemens JT2Go and Teamcenter Visualization
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary
Brian Gorenc and Mat Powell of Trend Micro Zero Day Initiative; garmin and xina1i at SecZone; and Tran Van Khang - khangkito (VinCSS) working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.
Exploitability
No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.
{
"document": {
"acknowledgments": [
{
"names": [
"Brian Gorenc",
"Mat Powell"
],
"organization": "Trend Micro Zero Day Initiative",
"summary": "reporting these vulnerabilities to CISA"
},
{
"names": [
"garmin",
"xina1i"
],
"organization": "SecZone",
"summary": "reporting these vulnerabilities to CISA"
},
{
"names": [
"Tran Van Khang - khangkito"
],
"organization": "VinCSS",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "summary",
"text": "Brian Gorenc and Mat Powell of Trend Micro Zero Day Initiative; garmin and xina1i at SecZone; and Tran Van Khang - khangkito (VinCSS) working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.",
"title": "Summary"
},
{
"category": "other",
"text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "CISAservicedesk@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-21-194-15 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-194-15.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-194-15 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-194-15"
}
],
"title": "ICSA-21-194-15_Siemens JT2Go and Teamcenter Visualization",
"tracking": {
"current_release_date": "2021-07-13T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA USCert CSAF Generator",
"version": "1"
}
},
"id": "ICSA-21-194-15",
"initial_release_date": "2021-07-13T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-07-13T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-21-194-15 Siemens JT2Go and Teamcenter Visualization"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 13.2",
"product": {
"name": "Teamcenter Visualization: All versions prior to v13.2",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "Teamcenter Visualization"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 13.2",
"product": {
"name": "JT2Go: All versions prior to v13.2",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "JT2Go"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-34333",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in a double free of an allocated buffer that leads to a crash. An attacker could leverage this vulnerability to cause denial-of-service condition.CVE-2021-34333 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34333"
},
{
"cve": "CVE-2021-34332",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in an infinite loop condition that leads to a denial-of-service condition. An attacker could leverage this vulnerability to consume excessive resources.CVE-2021-34332 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34332"
},
{
"cve": "CVE-2021-34331",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34331 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34331"
},
{
"cve": "CVE-2021-34330",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34330 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34330"
},
{
"cve": "CVE-2021-34329",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34329 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34329"
},
{
"cve": "CVE-2021-34328",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34328 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34328"
},
{
"cve": "CVE-2021-34327",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing ASM files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34327 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34327"
},
{
"cve": "CVE-2021-34326",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34326 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34326"
},
{
"cve": "CVE-2021-34325",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. CVE-2021-34325 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34325"
},
{
"cve": "CVE-2021-34324",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34324 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34324"
},
{
"cve": "CVE-2021-34323",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34323 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34323"
},
{
"cve": "CVE-2021-34322",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The JPEG2K_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. CVE-2021-34322 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34322"
},
{
"cve": "CVE-2021-34321",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The VisDraw.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34321 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34321"
},
{
"cve": "CVE-2021-34320",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34320 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34320"
},
{
"cve": "CVE-2021-34319",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34319 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34319 "
},
{
"cve": "CVE-2021-34318",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing PCT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34318 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34318"
},
{
"cve": "CVE-2021-34317",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing PCX files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34317 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34317"
},
{
"cve": "CVE-2021-34316",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The DL180CoolType.dll library in affected applications lacks proper validation of user-supplied data when parsing PDF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34316 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34316"
},
{
"cve": "CVE-2021-34315",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34315 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34315"
},
{
"cve": "CVE-2021-34314",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34314 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34314 "
},
{
"cve": "CVE-2021-34313",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34313 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34313"
},
{
"cve": "CVE-2021-34312",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34312 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34312"
},
{
"cve": "CVE-2021-34311",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Mono_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34311 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34311"
},
{
"cve": "CVE-2021-34310",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34310 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34310"
},
{
"cve": "CVE-2021-34309",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34309 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34309"
},
{
"cve": "CVE-2021-34308",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34308 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34308"
},
{
"cve": "CVE-2021-34307",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34307 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34307"
},
{
"cve": "CVE-2021-34306",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34306 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34306"
},
{
"cve": "CVE-2021-34305",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34305 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34305"
},
{
"cve": "CVE-2021-34304",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34304 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34304"
},
{
"cve": "CVE-2021-34303",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34303 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34303"
},
{
"cve": "CVE-2021-34302",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34302 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34302"
},
{
"cve": "CVE-2021-34301",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34301 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34301"
},
{
"cve": "CVE-2021-34300",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34300 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34300"
},
{
"cve": "CVE-2021-34299",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34299 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34299"
},
{
"cve": "CVE-2021-34298",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34298 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34298"
},
{
"cve": "CVE-2021-34297",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34297 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34297"
},
{
"cve": "CVE-2021-34296",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34296 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34296"
},
{
"cve": "CVE-2021-34295",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34295 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34295"
},
{
"cve": "CVE-2021-34294",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34294 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34294"
},
{
"cve": "CVE-2021-34293",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34293 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34293"
},
{
"cve": "CVE-2021-34292",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34292 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34292"
},
{
"cve": "CVE-2021-34291",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34291 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf"
},
{
"category": "mitigation",
"details": "JT2Go: Update to v13.2",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html"
},
{
"category": "mitigation",
"details": "Teamcenter Visualization: Update to v13.2 (login required)",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002"
],
"url": "https://support.sw.siemens.com/"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002"
]
}
],
"title": "CVE-2021-34291"
}
]
}
ghsa-cm7m-hh39-78r7
Vulnerability from github
Published
2022-05-24 19:07
Modified
2022-10-27 19:00
Severity ?
VLAI Severity ?
Details
A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)
{
"affected": [],
"aliases": [
"CVE-2021-34326"
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-20",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-13T11:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)",
"id": "GHSA-cm7m-hh39-78r7",
"modified": "2022-10-27T19:00:41Z",
"published": "2022-05-24T19:07:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34326"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
fkie_cve-2021-34326
Vulnerability from fkie_nvd
Published
2021-07-13 11:15
Modified
2024-11-21 06:10
Severity ?
Summary
A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)
References
| URL | Tags | ||
|---|---|---|---|
| productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf | Vendor Advisory | |
| productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf | Vendor Advisory | |
| productcert@siemens.com | https://www.zerodayinitiative.com/advisories/ZDI-21-864/ | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.zerodayinitiative.com/advisories/ZDI-21-864/ | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| siemens | jt2go | * | |
| siemens | solid_edge | * | |
| siemens | solid_edge | se2021 | |
| siemens | solid_edge | se2021 | |
| siemens | solid_edge | se2021 | |
| siemens | solid_edge | se2021 | |
| siemens | solid_edge | se2021 | |
| siemens | teamcenter_visualization | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CAFFF33E-9758-4C92-B2BF-2CF0E2EA6217",
"versionEndExcluding": "13.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*",
"matchCriteriaId": "576A303A-66CA-4694-AA54-9EB0137C24F1",
"versionEndExcluding": "se2021",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*",
"matchCriteriaId": "39D237BD-EE55-4B40-ABC3-194C4BF7C6CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*",
"matchCriteriaId": "49F5649A-349C-42C6-AFFF-CEE1ABC14E67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*",
"matchCriteriaId": "756343AA-DB57-40F7-94FA-84BFCDEB6159",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*",
"matchCriteriaId": "36B0DD28-653E-4069-AB5A-38F8EFEB36CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*",
"matchCriteriaId": "82090774-D894-41C8-82F1-A48A8707E9BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6C391214-6E11-4196-BF69-5327069864D8",
"versionEndExcluding": "13.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)"
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2), Solid Edge SE2021 (Todas las versiones anteriores a SE2021MP5), Teamcenter Visualization (Todas las versiones anteriores a V13.2). La biblioteca plmxmlAdapterSE70.dll de las aplicaciones afectadas no comprueba apropiadamente los datos suministrados por el usuario cuando se analizan los archivos PAR. Esto podr\u00eda resultar en una escritura fuera de l\u00edmites m\u00e1s all\u00e1 del b\u00fafer de fixed-length en la regi\u00f3n heap de la memoria. Un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual. (ZDI-CAN-13422)"
}
],
"id": "CVE-2021-34326",
"lastModified": "2024-11-21T06:10:10.323",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-13T11:15:12.927",
"references": [
{
"source": "productcert@siemens.com",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"source": "productcert@siemens.com",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"source": "productcert@siemens.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/"
}
],
"sourceIdentifier": "productcert@siemens.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "productcert@siemens.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
var-202107-1421
Vulnerability from variot
A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422). Zero Day Initiative To this vulnerability ZDI-CAN-13422 Was numbering.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PAR files. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "solid edge",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "se2021"
},
{
"_id": null,
"model": "jt2go",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "13.2.0"
},
{
"_id": null,
"model": "teamcenter visualization",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "13.2.0"
},
{
"_id": null,
"model": "solid edge",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "se2021"
},
{
"_id": null,
"model": "solid edge",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": null
},
{
"_id": null,
"model": "teamcenter visualization",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": "13.2"
},
{
"_id": null,
"model": "jt2go",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": null
},
{
"_id": null,
"model": "jt2go",
"scope": null,
"trust": 0.7,
"vendor": "siemens",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-864"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-009279"
},
{
"db": "NVD",
"id": "CVE-2021-34326"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "se2021",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-34326"
}
]
},
"credits": {
"_id": null,
"data": "Mat Powell of Trend Micro Zero Day Initiative",
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-864"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-923"
}
],
"trust": 1.3
},
"cve": "CVE-2021-34326",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2021-34326",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2021-34326",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2021-34326",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-34326",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2021-34326",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202107-923",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2021-34326",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-864"
},
{
"db": "VULMON",
"id": "CVE-2021-34326"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-009279"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-923"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2021-34326"
}
]
},
"description": {
"_id": null,
"data": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422). Zero Day Initiative To this vulnerability ZDI-CAN-13422 Was numbering.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PAR files. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-34326"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-009279"
},
{
"db": "ZDI",
"id": "ZDI-21-864"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULMON",
"id": "CVE-2021-34326"
}
],
"trust": 2.88
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2021-34326",
"trust": 4.0
},
{
"db": "ZDI",
"id": "ZDI-21-864",
"trust": 3.2
},
{
"db": "SIEMENS",
"id": "SSA-173615",
"trust": 1.7
},
{
"db": "SIEMENS",
"id": "SSA-483182",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2021-009279",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-13422",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2021.2403",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021071508",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202107-923",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-34326",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-864"
},
{
"db": "VULMON",
"id": "CVE-2021-34326"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-009279"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-923"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2021-34326"
}
]
},
"id": "VAR-202107-1421",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.15799868
},
"last_update_date": "2024-04-26T10:58:15.919000Z",
"patch": {
"_id": null,
"data": [
{
"title": "SSA-173615 Siemens\u00a0Security\u00a0Advisory",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"title": "",
"trust": 0.7,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"title": "Siemens Jt2go and Siemens Teamcenter Visualization Security vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=156616"
},
{
"title": "Siemens Security Advisories: Siemens Security Advisory",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=e172da356a059f9e1b4ef7215ce64ef1"
},
{
"title": "Siemens Security Advisories: Siemens Security Advisory",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=aa85c53444a3e0726ddb55922c9060c8"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-864"
},
{
"db": "VULMON",
"id": "CVE-2021-34326"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-009279"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-923"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-009279"
},
{
"db": "NVD",
"id": "CVE-2021-34326"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 3.1,
"url": "https://www.zerodayinitiative.com/advisories/zdi-21-864/"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-34326"
},
{
"trust": 0.7,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021071508"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2403"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-21-864"
},
{
"db": "VULMON",
"id": "CVE-2021-34326"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-009279"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-923"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2021-34326"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "ZDI",
"id": "ZDI-21-864",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2021-34326",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2021-009279",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-202107-923",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2021-34326",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2021-07-19T00:00:00",
"db": "ZDI",
"id": "ZDI-21-864",
"ident": null
},
{
"date": "2021-07-13T00:00:00",
"db": "VULMON",
"id": "CVE-2021-34326",
"ident": null
},
{
"date": "2022-04-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-009279",
"ident": null
},
{
"date": "2021-07-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202107-923",
"ident": null
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975",
"ident": null
},
{
"date": "2021-07-13T11:15:12.927000",
"db": "NVD",
"id": "CVE-2021-34326",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2021-07-19T00:00:00",
"db": "ZDI",
"id": "ZDI-21-864",
"ident": null
},
{
"date": "2021-07-19T00:00:00",
"db": "VULMON",
"id": "CVE-2021-34326",
"ident": null
},
{
"date": "2024-04-11T05:59:00",
"db": "JVNDB",
"id": "JVNDB-2021-009279",
"ident": null
},
{
"date": "2022-10-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202107-923",
"ident": null
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975",
"ident": null
},
{
"date": "2022-10-27T12:23:58.637000",
"db": "NVD",
"id": "CVE-2021-34326",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202107-923"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "Out-of-bounds write vulnerabilities in multiple Siemens products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-009279"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202107-923"
}
],
"trust": 0.6
}
}
cnvd-2021-51463
Vulnerability from cnvd
Title
Siemens Solid Edge堆缓冲区溢出漏洞（CNVD-2021-51463）
Description
Siemens Solid Edge是一组软件工具，用于处理各种产品开发过程：三维设计、仿真、制造和设计管理。
Siemens Solid Edge堆缓冲区溢出漏洞。该漏洞是由于在受影响的应用程序中，PLMXMLADATESE70.DLL库在解析PAR文件时缺乏对用户提供数据的正确验证。攻击者可以利用此漏洞在当前进程的上下文中执行代码。
Severity
中
VLAI Severity ?
Patch Name
Siemens Solid Edge堆缓冲区溢出漏洞（CNVD-2021-51463）的补丁
Patch Description
Siemens Solid Edge是一组软件工具，用于处理各种产品开发过程：三维设计、仿真、制造和设计管理。
Siemens Solid Edge堆缓冲区溢出漏洞。该漏洞是由于在受影响的应用程序中，PLMXMLADATESE70.DLL库在解析PAR文件时缺乏对用户提供数据的正确验证。攻击者可以利用此漏洞在当前进程的上下文中执行代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15
Reference
https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15
Impacted products
| Name | Siemens Solid Edge SE2021 < SE2021MP5 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2021-34326",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-34326"
}
},
"description": "Siemens Solid Edge\u662f\u4e00\u7ec4\u8f6f\u4ef6\u5de5\u5177\uff0c\u7528\u4e8e\u5904\u7406\u5404\u79cd\u4ea7\u54c1\u5f00\u53d1\u8fc7\u7a0b\uff1a\u4e09\u7ef4\u8bbe\u8ba1\u3001\u4eff\u771f\u3001\u5236\u9020\u548c\u8bbe\u8ba1\u7ba1\u7406\u3002\n\nSiemens Solid Edge\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u4e2d\uff0cPLMXMLADATESE70.DLL\u5e93\u5728\u89e3\u6790PAR\u6587\u4ef6\u65f6\u7f3a\u4e4f\u5bf9\u7528\u6237\u63d0\u4f9b\u6570\u636e\u7684\u6b63\u786e\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u5728\u5f53\u524d\u8fdb\u7a0b\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\u3002",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://us-cert.cisa.gov/ics/advisories/icsa-21-194-15",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2021-51463",
"openTime": "2021-07-16",
"patchDescription": "Siemens Solid Edge\u662f\u4e00\u7ec4\u8f6f\u4ef6\u5de5\u5177\uff0c\u7528\u4e8e\u5904\u7406\u5404\u79cd\u4ea7\u54c1\u5f00\u53d1\u8fc7\u7a0b\uff1a\u4e09\u7ef4\u8bbe\u8ba1\u3001\u4eff\u771f\u3001\u5236\u9020\u548c\u8bbe\u8ba1\u7ba1\u7406\u3002\r\n\r\nSiemens Solid Edge\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u7a0b\u5e8f\u4e2d\uff0cPLMXMLADATESE70.DLL\u5e93\u5728\u89e3\u6790PAR\u6587\u4ef6\u65f6\u7f3a\u4e4f\u5bf9\u7528\u6237\u63d0\u4f9b\u6570\u636e\u7684\u6b63\u786e\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u6f0f\u6d1e\u5728\u5f53\u524d\u8fdb\u7a0b\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Siemens Solid Edge\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2021-51463\uff09\u7684\u8865\u4e01",
"products": {
"product": "Siemens Solid Edge SE2021 \u003c SE2021MP5"
},
"referenceLink": "https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15",
"serverity": "\u4e2d",
"submitTime": "2021-07-14",
"title": "Siemens Solid Edge\u5806\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2021-51463\uff09"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…