CVE-2021-32946: 
Siemens JT2Go vulnerability analysis and mitigation

CVE-2021-32946 is a vulnerability discovered in the Drawings SDK (Version 2022.4 and prior) affecting the parsing of DGN files. The vulnerability was disclosed on June 17, 2021, and stems from improper validation of user-supplied data during file parsing operations. The vulnerability affects multiple products including Siemens JT2Go, Teamcenter Visualization, and Open Design Alliance Drawings SDK (NVD, CISA).

The vulnerability is classified as an improper check for unusual or exceptional conditions (CWE-754). The specific flaw exists within the parsing of DGN files, where lack of proper validation of user-supplied data can result in several out-of-bounds problems. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, no privileges required, and user interaction required (ZDI, CISA).

Successful exploitation of this vulnerability can allow attackers to cause a denial-of-service condition or execute arbitrary code in the context of the current process. The vulnerability could potentially lead to complete compromise of the affected system's confidentiality, integrity, and availability (CISA, ZDI).

The vulnerability requires user interaction to exploit, specifically the target must open a malicious DGN file. The attack is not exploitable remotely, requiring local access to the system. No known public exploits specifically targeting this vulnerability have been reported (CISA).

Open Design Alliance recommends updating to v2022.5 or later. Additional mitigation measures include: only using project files from trusted sources, ensuring the least-privilege user principle is followed, and not clicking web links or opening unsolicited attachments. Organizations should also minimize network exposure for all control system devices and ensure they are not accessible from the Internet (CISA).