CVE-2024-32636
📋 TL;DR
This vulnerability allows remote code execution through specially crafted X_T files in Siemens JT2Go and Teamcenter Visualization software. An attacker could execute arbitrary code in the context of the current process by exploiting an out-of-bounds read vulnerability. Organizations using affected versions of these CAD visualization tools are at risk.
💻 Affected Systems
- JT2Go
- Teamcenter Visualization V14.2
- Teamcenter Visualization V14.3
- Teamcenter Visualization V2312
📦 What is this software?
Jt2go by Siemens
Parasolid by Siemens
Parasolid by Siemens
Parasolid by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running the vulnerable application, potentially leading to data theft, lateral movement, or ransomware deployment.
Likely Case
Local privilege escalation or arbitrary code execution when a user opens a malicious X_T file, potentially leading to data exfiltration or system compromise.
If Mitigated
Limited impact with proper application sandboxing, user privilege restrictions, and file validation controls in place.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious X_T file. No authentication bypass needed beyond file access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: JT2Go/V2312: V2312.0005, V14.2: V14.2.0.12, V14.3: V14.3.0.10
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-046364.html
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Siemens support portal. 2. Backup current installation. 3. Run the installer with administrative privileges. 4. Restart the system. 5. Verify the new version is installed.
🔧 Temporary Workarounds
Restrict X_T file processing
allBlock or restrict processing of X_T files through application settings or group policies
Application sandboxing
allRun vulnerable applications in isolated environments with restricted permissions
🧯 If You Can't Patch
- Implement strict file validation for all X_T files before opening
- Run applications with minimal user privileges and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check application version against affected versions list. If using JT2Go/V2312, versions below V2312.0005 are vulnerable.Check Version:
In JT2Go: Help → About; In Teamcenter Visualization: Help → About or check installation propertiesVerify Fix Applied:
Verify the installed version matches or exceeds the patched version for your product line.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening X_T files
- Unusual process creation from visualization applications
- Failed file parsing attempts
Network Indicators:
- Unexpected outbound connections from visualization applications
- File downloads followed by application crashes
SIEM Query:
Process creation where parent process contains 'jt2go' or 'teamcenter' AND command line contains '.x_t'