CVE-2020-26999
📋 TL;DR
This vulnerability in Siemens JT2Go and Teamcenter Visualization allows attackers to leak sensitive information by exploiting improper validation of PAR files. It affects all versions before V13.1.0.2 and could lead to memory buffer over-reads. Organizations using these applications for CAD file viewing and collaboration are at risk.
💻 Affected Systems
- JT2Go
- Teamcenter Visualization
📦 What is this software?
Jt2go by Siemens
⚠️ Risk & Real-World Impact
Worst Case
An attacker could exfiltrate sensitive memory contents, potentially including authentication credentials, proprietary design data, or system information, leading to intellectual property theft or further system compromise.
Likely Case
Information disclosure of adjacent memory contents, which could reveal application data, configuration details, or system information useful for further attacks.
If Mitigated
Limited impact with proper network segmentation and file validation controls, potentially preventing successful exploitation or limiting data exposure.
🎯 Exploit Status
Exploitation requires ability to supply malicious PAR files to the application. No public exploit code is available, but vulnerability details are published.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V13.1.0.2
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
Restart Required: Yes
Instructions:
1. Download V13.1.0.2 or later from Siemens support portal. 2. Backup current installation. 3. Run installer with administrative privileges. 4. Restart system after installation completes.
🔧 Temporary Workarounds
Restrict PAR file processing
allBlock or restrict processing of PAR files through application configuration or external controls
Network segmentation
allIsolate JT2Go and Teamcenter Visualization systems from untrusted networks
🧯 If You Can't Patch
- Implement strict file validation for PAR files before processing
- Monitor for suspicious PAR file processing and memory access patterns
🔍 How to Verify
Check if Vulnerable:
Check application version in Help > About menu or via installed programs listCheck Version:
On Windows: wmic product where name="JT2Go" get versionVerify Fix Applied:
Confirm version is V13.1.0.2 or later and test PAR file processing functionality📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing PAR files
- Unusual memory access patterns in application logs
- Failed PAR file parsing attempts
Network Indicators:
- Unexpected outbound data transfers after PAR file processing
- Network connections to suspicious destinations
SIEM Query:
source="application_logs" AND (event="crash" OR event="memory_error") AND process="jt2go.exe"🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-21-239/
- https://www.zerodayinitiative.com/advisories/ZDI-21-860/
- https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-695540.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-21-239/
- https://www.zerodayinitiative.com/advisories/ZDI-21-860/
