CVE-2021-25174: 
Siemens JT2Go vulnerability analysis and mitigation

An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart). The vulnerability was assigned CVE-2021-25174 and discovered in January 2021 (NVD, CVE).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) with a CVSS v3.1 base score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The issue stems from lack of proper validation of user-supplied data when reading malformed DGN files, which can result in memory corruption (ZDI Advisory).

Successful exploitation of this vulnerability could allow attackers to cause a system crash leading to denial of service conditions including crash, exit, or restart of the affected application. The vulnerability has high confidentiality, integrity and availability impacts according to the CVSS score (NVD).

The vulnerability requires local access and user interaction to exploit, as the target must open a malicious DGN file. The attack complexity is considered low, and no special privileges are required to execute the attack (ZDI Advisory).

Open Design Alliance has released version 2021.12 which fixes this vulnerability. Users are advised to update to this version or later. Additionally, Siemens has released updates for affected products including JT2Go and Teamcenter Visualization to version 13.1.0.1 or later (Siemens Advisory).