CVE-2020-27002: 
Siemens JT2Go vulnerability analysis and mitigation

A vulnerability has been identified in JT2Go (All versions < V13.1.0.2) and Teamcenter Visualization (All versions < V13.1.0.2). The affected applications lack proper validation of user-supplied data when parsing PAR files, which could result in a memory access past the end of an allocated buffer (CISA Advisory, Siemens Advisory).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) issue. When parsing PAR files, the applications fail to properly validate user-supplied data, leading to memory access beyond allocated buffer boundaries. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (NVD).

An attacker could leverage this vulnerability to access sensitive data in the context of the current process, potentially leading to information disclosure (ZDI Advisory).

The vulnerability requires local access and user interaction, as the target must open a malicious file. No known public exploits specifically targeting this vulnerability have been reported (CISA Advisory).

Siemens has released patches to address this vulnerability. Users should update JT2Go to version 13.1.0.2 or later, and Teamcenter Visualization to version 13.1.0.2 or later. As a general security measure, Siemens strongly recommends limiting the opening of untrusted files in systems where these applications are installed (Siemens Advisory).