CVE-2021-34323: 
Siemens JT2Go vulnerability analysis and mitigation

CVE-2021-34323 is a vulnerability affecting Siemens JT2Go software versions prior to v13.2. The vulnerability was discovered in 2021 and involves an out-of-bounds write issue in the Jt981.dll library when parsing JT files (ZDI Advisory, CISA Advisory).

The vulnerability exists within the parsing of JT files in the Jt981.dll library. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. The vulnerability has been assigned a CVSS v3 base score of 7.8 with the vector string (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (ZDI Advisory, CISA Advisory).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the current process. The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires local access and user interaction to exploit. There are no known public exploits specifically targeting this vulnerability, and it is not exploitable remotely (CISA Advisory).

Siemens has released version 13.2 of JT2Go to address this vulnerability. Users are recommended to update to this version. As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' Operational Guidelines for Industrial Security (CISA Advisory).