CVE-2020-26982: 
Siemens JT2Go vulnerability analysis and mitigation

CVE-2020-26982 is a vulnerability affecting Siemens JT2Go and Teamcenter Visualization software. The vulnerability was discovered in 2020 and disclosed in January 2021. The issue exists within the parsing of CG4 and CGM files, where the application lacks proper validation of user-supplied data, which can result in an out-of-bounds write past the end of an allocated structure (ZDI, CISA).

The vulnerability is classified as an Out-of-Bounds Write (CWE-787) issue. It has been assigned a CVSS v3 base score of 7.8, with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability requires local access and user interaction, but no privileges, while potentially leading to high impacts on confidentiality, integrity, and availability (CISA).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The attacker could leverage this vulnerability to gain the same privileges as the compromised application (ZDI, CISA).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, meaning the attack can be performed with minimal additional conditions required (ZDI).

Siemens has released updates to address this vulnerability. Users are recommended to update JT2Go to v13.1.0 or later and Teamcenter Visualization to v13.1.0 or later. Additionally, users should limit the opening of untrusted files in systems where these applications are installed and apply defense-in-depth concepts to reduce the probability of untrusted code execution (CISA).