Threat Investigation
Request a demo

CVE-2024-37996

Low

Description

A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter Visualization V14.2 (All versions < V14.2.0.13), Teamcenter Visualization V14.3 (All versions < V14.3.0.11), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All versions < V2406.0003). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted XML files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.

SeverityLow
CVSS3.3
Exploit probability—
ProductJT2Go
PublishedJul 9, 2024
First seenJul 9, 2024
Weakness typeCWE-476NULL pointer dereference

How to fix

Update
  • Siemens JT2GoV2406.0003 or later
  • Siemens JT OpenV11.5 or later
  • Siemens PLM XML SDKV7.1.0.014 or later
  • Siemens Teamcenter Visualization V14.2V14.2.0.13 or later
  • Siemens Teamcenter Visualization V14.3V14.3.0.11 or later
  • Siemens Teamcenter Visualization V2312V2312.0008 or later
  • Siemens Teamcenter Visualization V2406V2406.0003 or later

Affected products

ProductAffected versionsFixed in
Siemens JT2Gov < V2406.0003V2406.0003
Siemens JT Openv < V11.5V11.5
Siemens PLM XML SDKv < V7.1.0.014V7.1.0.014
Siemens Teamcenter Visualization V14.2v < V14.2.0.13V14.2.0.13
Siemens Teamcenter Visualization V14.3v < V14.3.0.11V14.3.0.11
Siemens Teamcenter Visualization V2312v < V2312.0008V2312.0008
Siemens Teamcenter Visualization V2406v < V2406.0003V2406.0003

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.