High severity · published Aug 12, 2024
CVE-2023-7066
Siemens Teamcenter Visualization and JT2Go Out-of-bounds Read
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
The affected applications contain an out of bounds read past the end of
an allocated structure while parsing specially crafted PDF files. This
could allow an attacker to execute code in the context of the current
process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JT
JT2Go · Siemens
before V14.3.0.8 · source: vendor, CISA
TV
Teamcenter Visualization · Siemens
before V14.1.0.14; before V14.2.0.10; before V14.3.0.8; before V2312.0002 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-7066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-7066
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-722010.html
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-03
More from JT2Go
8.8
CVE-2020-26996
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0)
8.8
CVE-2020-26995
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0)
8.8
CVE-2020-26994
A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0)
8.8
CVE-2020-26991
A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2)
8.8
CVE-2020-26990
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1)