CVE-2021-44013
📋 TL;DR
This vulnerability allows remote code execution through specially crafted JT files in Siemens JT2Go and Teamcenter Visualization software. Attackers can exploit an out-of-bounds write vulnerability in DL180pdfl.dll to execute arbitrary code with the privileges of the current process. All users of affected versions are at risk.
💻 Affected Systems
- Siemens JT2Go
- Siemens Teamcenter Visualization
📦 What is this software?
Jt2go by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to install malware, steal data, or pivot to other systems in the network.
Likely Case
Malicious code execution leading to data theft, ransomware deployment, or system disruption.
If Mitigated
Limited impact if proper network segmentation and file validation controls prevent malicious JT files from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious JT file. No public exploit code is available, but the vulnerability is documented by ZDI.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V13.2.0.5 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
Restart Required: Yes
Instructions:
1. Download V13.2.0.5 or later from Siemens support portal. 2. Install the update following vendor instructions. 3. Restart affected systems.
🔧 Temporary Workarounds
Disable JT file association
windowsPrevent JT files from automatically opening in vulnerable applications
Use Windows File Association settings to change default program for .jt files
Application whitelisting
windowsRestrict execution of JT2Go and Teamcenter Visualization to trusted locations only
Configure Windows AppLocker or similar whitelisting solution
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy email/web filtering to block malicious JT files and educate users about the risk
🔍 How to Verify
Check if Vulnerable:
Check software version in Help > About in JT2Go or Teamcenter VisualizationCheck Version:
Not applicable - check via application GUIVerify Fix Applied:
Confirm version is V13.2.0.5 or later in application about dialog📡 Detection & Monitoring
Log Indicators:
- Application crashes in JT2Go or Teamcenter Visualization
- Unusual process creation from these applications
Network Indicators:
- Downloads of JT files from untrusted sources
- Outbound connections from these applications to suspicious IPs
SIEM Query:
Process creation where parent process contains 'jt2go' or 'teamcenter' AND child process is suspicious