Vulnerability · Published Jan 12, 2021 · Assigned by siemens

CVE-2020-28383

High 7.8

In plain English

A high-severity out-of-bounds write in JT2Go from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities).

Severity (CVSS NVD)7.8High

Exploit odds (30 days)3.6%top 10.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing PAR files. This can result in an out of bounds write past the memory location that is a read only image address. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11885)

Affected products (as reported)

Vendor	Product	Versions
Siemens	JT2Go	All versions < V13.1.0.1
Siemens	Solid Edge SE2020	All Versions < SE2020MP12
Siemens	Solid Edge SE2021	All Versions < SE2021MP2
Siemens	Teamcenter Visualization	All versions < V13.1.0.1

Weakness: CWE-787

References

https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-054/ x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf x_refsource_MISC
https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04 x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-047/ x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-073/ x_refsource_MISC