CVE-2020-26990: 
Siemens JT2Go vulnerability analysis and mitigation

A type confusion vulnerability (CVE-2020-26990) was discovered in Siemens JT2Go (All versions < V13.1.0.1) and Teamcenter Visualization (All versions < V13.1.0.1). The vulnerability stems from improper validation of user-supplied data when parsing ASM files. The issue was disclosed in January 2021 and received a CVSS v3.1 base score of 8.8 (HIGH) (NVD, ZDI).

The vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type). When parsing ASM files, the affected applications lack proper validation of user-supplied data, which can trigger a type confusion condition. The vulnerability received a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impacts to confidentiality, integrity, and availability (NVD).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. This means an attacker could potentially take complete control of the affected system with the same privileges as the application (ZDI).

The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file. While no public exploits were specifically reported targeting this vulnerability, the Zero Day Initiative confirmed the vulnerability could be leveraged for code execution (ZDI).

Siemens addressed this vulnerability by releasing version 13.1.0.1 for both JT2Go and Teamcenter Visualization. Users are advised to update to these versions or later. Additionally, Siemens recommends limiting the opening of untrusted files in systems where these applications are installed and applying a defense-in-depth approach (CISA).