CVE-2020-26990
📋 TL;DR
This vulnerability allows remote code execution through specially crafted ASM files in Siemens JT2Go and Teamcenter Visualization software. Attackers can exploit type confusion when parsing these files to execute arbitrary code with the privileges of the current user. All users of affected versions are at risk.
💻 Affected Systems
- Siemens JT2Go
- Siemens Teamcenter Visualization
📦 What is this software?
Jt2go by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running the vulnerable application, potentially leading to lateral movement, data theft, or ransomware deployment.
Likely Case
Malicious ASM files delivered via phishing or compromised websites lead to code execution on user workstations, enabling credential theft, data exfiltration, or further malware installation.
If Mitigated
With proper controls, exploitation attempts are blocked at network boundaries, files are scanned before opening, and user privileges are limited, reducing impact to isolated workstation compromise.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious ASM file; no authentication bypass is needed once the file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V13.1.0.1 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf
Restart Required: Yes
Instructions:
1. Download the latest version from Siemens support portal. 2. Install the update following vendor instructions. 3. Restart affected systems.
🔧 Temporary Workarounds
Block ASM file extensions
allPrevent opening of ASM files via email filters or endpoint protection
Restrict application execution
windowsUse application whitelisting to prevent unauthorized execution of JT2Go/Teamcenter Visualization
🧯 If You Can't Patch
- Implement strict email filtering to block ASM attachments
- Train users to never open ASM files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check application version in Help > About; if version is below 13.1.0.1, system is vulnerable.Check Version:
Not applicable - check via GUI in Help > AboutVerify Fix Applied:
Verify version is 13.1.0.1 or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening ASM files
- Unusual process creation from JT2Go/Teamcenter processes
Network Indicators:
- Downloads of ASM files from untrusted sources
- Outbound connections from JT2Go/Teamcenter to suspicious IPs
SIEM Query:
Process creation where parent process contains 'jt2go' or 'teamcenter' and child process is unusual🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-21-055/
- https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-21-055/
