Threat Investigation
Request a demo

CVE-2024-26277

Low

Description

A vulnerability has been identified in JT2Go (All versions < V2312.0004), Parasolid V35.1 (All versions < V35.1.254), Parasolid V36.0 (All versions < V36.0.207), Parasolid V36.1 (All versions < V36.1.147), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), Teamcenter Visualization V14.3 (All versions < V14.3.0.9), Teamcenter Visualization V2312 (All versions < V2312.0004). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted X_T files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.

SeverityLow
CVSS3.3
Exploit probability—
ProductJT2Go
PublishedApr 9, 2024
First seenApr 9, 2024
Weakness typeCWE-476NULL pointer dereference

How to fix

Update
  • Siemens JT2GoV2312.0004 or later
  • Siemens Parasolid V35.1V35.1.254 or later
  • Siemens Parasolid V36.0V36.0.207 or later
  • Siemens Parasolid V36.1V36.1.147 or later
  • Siemens Teamcenter Visualization V14.2V14.2.0.12 or later
  • Siemens Teamcenter Visualization V14.3V14.3.0.9 or later
  • Siemens Teamcenter Visualization V2312V2312.0004 or later

Affected products

ProductAffected versionsFixed in
Siemens JT2Gov < V2312.0004V2312.0004
Siemens Parasolid V35.1v < V35.1.254V35.1.254
Siemens Parasolid V36.0v < V36.0.207V36.0.207
Siemens Parasolid V36.1v < V36.1.147V36.1.147
Siemens Teamcenter Visualization V14.2v < V14.2.0.12V14.2.0.12
Siemens Teamcenter Visualization V14.3v < V14.3.0.9V14.3.0.9
Siemens Teamcenter Visualization V2312v < V2312.0004V2312.0004

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.