CVE-2021-34328
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by exploiting a heap buffer overflow in Siemens JT2Go, Solid Edge SE2021, and Teamcenter Visualization software. The flaw exists in the plmxmlAdapterSE70.dll library which fails to properly validate PAR file data, enabling out-of-bounds writes. Organizations using these Siemens CAD/visualization products are affected.
💻 Affected Systems
- JT2Go
- Solid Edge SE2021
- Teamcenter Visualization
📦 What is this software?
Jt2go by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
Solid Edge by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with the privileges of the current process, potentially leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Local privilege escalation or remote code execution when users open malicious PAR files, potentially leading to lateral movement within networks.
If Mitigated
Limited impact with proper application whitelisting, file validation, and user privilege restrictions in place.
🎯 Exploit Status
Exploitation requires user interaction to open malicious PAR files. No public exploit code is available, but the vulnerability is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: JT2Go V13.2+, Solid Edge SE2021 MP5+, Teamcenter Visualization V13.2+
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf
Restart Required: Yes
Instructions:
1. Download patches from Siemens support portal. 2. Apply updates to affected products. 3. Restart systems. 4. Verify version numbers match patched versions.
🔧 Temporary Workarounds
Block PAR file extensions
windowsPrevent processing of potentially malicious PAR files by blocking the file extension at network or host level.
Restrict user privileges
windowsRun affected applications with minimal user privileges to limit potential damage from exploitation.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Use network segmentation to isolate CAD/visualization systems from critical infrastructure
🔍 How to Verify
Check if Vulnerable:
Check installed version numbers against affected ranges: JT2Go < V13.2, Solid Edge SE2021 < SE2021MP5, Teamcenter Visualization < V13.2Check Version:
Check application 'About' dialog or use Windows Programs and Features to verify installed versionsVerify Fix Applied:
Confirm version numbers match or exceed patched versions: JT2Go V13.2+, Solid Edge SE2021 MP5+, Teamcenter Visualization V13.2+📡 Detection & Monitoring
Log Indicators:
- Application crashes related to plmxmlAdapterSE70.dll
- Unexpected process creation from CAD/visualization applications
- Failed attempts to load or parse PAR files
Network Indicators:
- Unusual network connections originating from CAD workstations
- File transfers of PAR files to/from CAD systems
SIEM Query:
Process creation events where parent process is JT2Go.exe, SolidEdge.exe, or Teamcenter Visualization executables🔗 References
- https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-21-866/
- https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf
- https://www.zerodayinitiative.com/advisories/ZDI-21-866/
