CVE-2020-26981: 
Siemens JT2Go vulnerability analysis and mitigation

A vulnerability (CVE-2020-26981) was identified in JT2Go (All versions < V13.1.0) and Teamcenter Visualization (All versions < V13.1.0). The vulnerability was discovered in 2020 and disclosed on January 14, 2021. When opening a specially crafted XML file, the application could disclose arbitrary files to remote attackers due to improper restriction of XML External Entity (XXE) references in the XML parser (ZDI Advisory, NVD).

The vulnerability is classified as an Improper Restriction of XML External Entity Reference (CWE-611). It has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The specific flaw exists within the parsing of PLMXML files, where specially crafted content passed to the underlying XML parser lacks proper restrictions such as prohibiting an external DTD (CISA Advisory, ZDI Advisory).

The vulnerability allows attackers to disclose sensitive information in the context of the current process. When successfully exploited, it could lead to the disclosure of arbitrary files to remote attackers (ZDI Advisory).

User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file. The vulnerability requires low attack complexity but needs user interaction for successful exploitation (ZDI Advisory).

Siemens has released updates to address this vulnerability. Users of affected products should update to JT2Go v13.1.0 or later and Teamcenter Visualization v13.1.0 or later. Additionally, Siemens recommends limiting the opening of untrusted files in systems where JT2Go or Teamcenter Visualization is installed and applying a defense-in-depth concept (CISA Advisory).