CVE-2023-28830
📋 TL;DR
A use-after-free vulnerability in Siemens JT2Go, Solid Edge, and Teamcenter Visualization applications allows remote code execution when parsing malicious ASM files. Attackers can execute arbitrary code with the privileges of the current process. Users of affected versions of these CAD/visualization software products are at risk.
💻 Affected Systems
- JT2Go
- Solid Edge SE2022
- Solid Edge SE2023
- Teamcenter Visualization V13.2
- Teamcenter Visualization V13.3
- Teamcenter Visualization V14.1
- Teamcenter Visualization V14.2
📦 What is this software?
Jt2go by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or application compromise leading to data exfiltration from CAD files and system manipulation.
If Mitigated
Limited impact with proper network segmentation, application sandboxing, and user privilege restrictions.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious ASM file. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: JT2Go V14.2.0.5, Solid Edge SE2022 V222.0 Update 13, Solid Edge SE2023 V223.0 Update 4, Teamcenter Visualization V13.2 V13.2.0.15, V13.3 V13.3.0.11, V14.1 V14.1.0.11, V14.2 V14.2.0.5
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-131450.pdf
Restart Required: Yes
Instructions:
1. Download the latest version from Siemens support portal. 2. Install the update following vendor instructions. 3. Restart the system. 4. Verify the patch is applied.
🔧 Temporary Workarounds
Restrict ASM file handling
windowsBlock or restrict processing of ASM files through application settings or group policy.
Application sandboxing
windowsRun affected applications in isolated environments or with reduced privileges.
🧯 If You Can't Patch
- Implement strict file validation for ASM files before opening
- Use network segmentation to isolate CAD workstations from critical systems
🔍 How to Verify
Check if Vulnerable:
Check application version in Help > About or program properties against affected version ranges.Check Version:
For Windows: Check program version in Control Panel > Programs and Features or application's About dialog.Verify Fix Applied:
Confirm installed version matches or exceeds patched versions listed in vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening ASM files
- Unexpected process creation from CAD applications
- File access to suspicious ASM files
Network Indicators:
- Downloads of ASM files from untrusted sources
- Outbound connections from CAD applications to unknown IPs
SIEM Query:
Process creation events from jt2go.exe or solid edge executables followed by network connections or file writes