CVE-2023-7066 (GCVE-0-2023-7066)

Vulnerability from cvelistv5 – Published: 2024-08-12 21:46 – Updated: 2025-08-27 20:42
VLAI?
Summary
The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.3 (High)
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Siemens JT2Go Affected: 0 , < V14.3.0.8 (custom)
Create a notification for this product.
    Siemens Teamcenter Visualization Affected: 0 , < V14.1.0.14 (custom)
Affected: 0 , < V14.2.0.10 (custom)
Affected: 0 , < V14.3.0.8 (custom)
Affected: 0 , < V2312.0002 (custom)
Create a notification for this product.
Credits
MoyunSec reported this vulnerability to Siemens.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jt2go",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "14.3.0.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamcenter_visualization",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "14.1.0.14",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "14.2.0.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "14.3.0.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "2312.0002",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamcenter_visualization",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "14.1.0.14",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "14.2.0.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "14.3.0.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "2312.0002",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamcenter_visualization",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "14.1.0.14",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "14.2.0.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "14.3.0.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "2312.0002",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "teamcenter_visualization",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "14.1.0.14",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "14.2.0.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "14.3.0.8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "2312.0002",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-7066",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T13:56:38.749766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-27T20:42:53.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JT2Go",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V14.3.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamcenter Visualization",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V14.1.0.14",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "V14.2.0.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "V14.3.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "V2312.0002",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MoyunSec reported this vulnerability to Siemens."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The affected applications contain an out of bounds read past the end of \nan allocated structure while parsing specially crafted PDF files. This \ncould allow an attacker to execute code in the context of the current \nprocess."
            }
          ],
          "value": "The affected applications contain an out of bounds read past the end of \nan allocated structure while parsing specially crafted PDF files. This \ncould allow an attacker to execute code in the context of the current \nprocess."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-12T21:46:38.910Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-722010.html"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-03"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\nSiemens has released new versions for the affected products and recommends to update to the latest versions.\n\n:\u003c/p\u003e\u003cul\u003e\u003cli\u003eTeamcenter Visualization V14.1: Update to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eV14.1.0.14 or later version\u003c/a\u003e\u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.2: Update to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eV14.2.0.10 or later version\u003c/a\u003e\u003c/li\u003e\u003cli\u003eJT2Go: Update to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://plm.sw.siemens.com/en-US/plmcomponents/jt/jt2go/\"\u003eV14.3.0.8 or later version\u003c/a\u003e\u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.3: Update to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eV14.3.0.8 or later version\u003c/a\u003e\u003c/li\u003e\u003cli\u003eTeamcenter Visualization V2312: Update to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eV2312.0002 or later version\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\nFor more information see the associated Siemens security advisory SSA-722010\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Siemens has released new versions for the affected products and recommends to update to the latest versions.\n\n:\n\n  *  Teamcenter Visualization V14.1: Update to  V14.1.0.14 or later version https://support.sw.siemens.com/ \n  *  Teamcenter Visualization V14.2: Update to  V14.2.0.10 or later version https://support.sw.siemens.com/ \n  *  JT2Go: Update to  V14.3.0.8 or later version https://plm.sw.siemens.com/en-US/plmcomponents/jt/jt2go/ \n  *  Teamcenter Visualization V14.3: Update to  V14.3.0.8 or later version https://support.sw.siemens.com/ \n  *  Teamcenter Visualization V2312: Update to  V2312.0002 or later version https://support.sw.siemens.com/ \n\n\n\nFor more information see the associated Siemens security advisory SSA-722010"
        }
      ],
      "source": {
        "advisory": "ICSA-24-193-03",
        "discovery": "EXTERNAL"
      },
      "title": "Siemens Teamcenter Visualization and JT2Go Out-of-bounds Read",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTo reduce risk, Siemens \nrecommends users not open untrusted PDF files in affected applications.\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\n\u003c/ul\u003e\n\u003cp\u003eAs a general security measure, Siemens recommends protecting network \naccess to devices with appropriate mechanisms. To operate the devices in\n a protected IT environment, Siemens recommends configuring the \nenvironment according to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/cert/operational-guidelines-industrial-security\"\u003eSiemens\u0027 operational guidelines for industrial security\u003c/a\u003e and following recommendations in the product manuals.\u003c/p\u003e\n\u003cp\u003eAdditional information on industrial security by Siemens can be found on the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/industrialsecurity\"\u003eSiemens industrial security webpage\u003c/a\u003e\u003c/p\u003eFor more information see the associated Siemens security advisory SSA-722010\n\n\u003cbr\u003e"
            }
          ],
          "value": "To reduce risk, Siemens \nrecommends users not open untrusted PDF files in affected applications.\n\n\n\n\n\n\nAs a general security measure, Siemens recommends protecting network \naccess to devices with appropriate mechanisms. To operate the devices in\n a protected IT environment, Siemens recommends configuring the \nenvironment according to  Siemens\u0027 operational guidelines for industrial security https://www.siemens.com/cert/operational-guidelines-industrial-security  and following recommendations in the product manuals.\n\n\nAdditional information on industrial security by Siemens can be found on the  Siemens industrial security webpage https://www.siemens.com/industrialsecurity \n\nFor more information see the associated Siemens security advisory SSA-722010"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2023-7066",
    "datePublished": "2024-08-12T21:46:38.910Z",
    "dateReserved": "2023-12-21T19:40:53.933Z",
    "dateUpdated": "2025-08-27T20:42:53.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The affected applications contain an out of bounds read past the end of \\nan allocated structure while parsing specially crafted PDF files. This \\ncould allow an attacker to execute code in the context of the current \\nprocess.\"}, {\"lang\": \"es\", \"value\": \"Las aplicaciones afectadas contienen una lectura fuera de los l\\u00edmites m\\u00e1s all\\u00e1 del final de una estructura asignada mientras analizan archivos PDF especialmente manipulados. Esto podr\\u00eda permitir a un atacante ejecutar c\\u00f3digo en el contexto del proceso actual.\"}]",
      "id": "CVE-2023-7066",
      "lastModified": "2024-08-13T12:58:25.437",
      "metrics": "{\"cvssMetricV40\": [{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"PASSIVE\", \"vulnerableSystemConfidentiality\": \"HIGH\", \"vulnerableSystemIntegrity\": \"HIGH\", \"vulnerableSystemAvailability\": \"HIGH\", \"subsequentSystemConfidentiality\": \"NONE\", \"subsequentSystemIntegrity\": \"NONE\", \"subsequentSystemAvailability\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"confidentialityRequirements\": \"NOT_DEFINED\", \"integrityRequirements\": \"NOT_DEFINED\", \"availabilityRequirements\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"NOT_DEFINED\", \"modifiedAttackComplexity\": \"NOT_DEFINED\", \"modifiedAttackRequirements\": \"NOT_DEFINED\", \"modifiedPrivilegesRequired\": \"NOT_DEFINED\", \"modifiedUserInteraction\": \"NOT_DEFINED\", \"modifiedVulnerableSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedVulnerableSystemIntegrity\": \"NOT_DEFINED\", \"modifiedVulnerableSystemAvailability\": \"NOT_DEFINED\", \"modifiedSubsequentSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedSubsequentSystemIntegrity\": \"NOT_DEFINED\", \"modifiedSubsequentSystemAvailability\": \"NOT_DEFINED\", \"safety\": \"NOT_DEFINED\", \"automatable\": \"NOT_DEFINED\", \"recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\"}}], \"cvssMetricV31\": [{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-08-12T22:15:08.770",
      "references": "[{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-722010.html\", \"source\": \"ics-cert@hq.dhs.gov\"}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-03\", \"source\": \"ics-cert@hq.dhs.gov\"}]",
      "sourceIdentifier": "ics-cert@hq.dhs.gov",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-7066\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2024-08-12T22:15:08.770\",\"lastModified\":\"2024-08-13T12:58:25.437\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The affected applications contain an out of bounds read past the end of \\nan allocated structure while parsing specially crafted PDF files. This \\ncould allow an attacker to execute code in the context of the current \\nprocess.\"},{\"lang\":\"es\",\"value\":\"Las aplicaciones afectadas contienen una lectura fuera de los l\u00edmites m\u00e1s all\u00e1 del final de una estructura asignada mientras analizan archivos PDF especialmente manipulados. Esto podr\u00eda permitir a un atacante ejecutar c\u00f3digo en el contexto del proceso actual.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-722010.html\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-03\",\"source\":\"ics-cert@hq.dhs.gov\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-7066\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-14T13:56:38.749766Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*\"], \"vendor\": \"siemens\", \"product\": \"jt2go\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.3.0.8\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*\"], \"vendor\": \"siemens\", \"product\": \"teamcenter_visualization\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.1.0.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.2.0.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.3.0.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2312.0002\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*\"], \"vendor\": \"siemens\", \"product\": \"teamcenter_visualization\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.1.0.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.2.0.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.3.0.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2312.0002\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*\"], \"vendor\": \"siemens\", \"product\": \"teamcenter_visualization\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.1.0.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.2.0.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.3.0.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2312.0002\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*\"], \"vendor\": \"siemens\", \"product\": \"teamcenter_visualization\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.1.0.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.2.0.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"14.3.0.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2312.0002\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-14T14:02:31.105Z\"}}], \"cna\": {\"title\": \"Siemens Teamcenter Visualization and JT2Go Out-of-bounds Read\", \"source\": {\"advisory\": \"ICSA-24-193-03\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"MoyunSec reported this vulnerability to Siemens.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Siemens\", \"product\": \"JT2Go\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V14.3.0.8\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Siemens\", \"product\": \"Teamcenter Visualization\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V14.1.0.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V14.2.0.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V14.3.0.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V2312.0002\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Siemens has released new versions for the affected products and recommends to update to the latest versions.\\n\\n:\\n\\n  *  Teamcenter Visualization V14.1: Update to  V14.1.0.14 or later version https://support.sw.siemens.com/ \\n  *  Teamcenter Visualization V14.2: Update to  V14.2.0.10 or later version https://support.sw.siemens.com/ \\n  *  JT2Go: Update to  V14.3.0.8 or later version https://plm.sw.siemens.com/en-US/plmcomponents/jt/jt2go/ \\n  *  Teamcenter Visualization V14.3: Update to  V14.3.0.8 or later version https://support.sw.siemens.com/ \\n  *  Teamcenter Visualization V2312: Update to  V2312.0002 or later version https://support.sw.siemens.com/ \\n\\n\\n\\nFor more information see the associated Siemens security advisory SSA-722010\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\\nSiemens has released new versions for the affected products and recommends to update to the latest versions.\\n\\n:\u003c/p\u003e\u003cul\u003e\u003cli\u003eTeamcenter Visualization V14.1: Update to \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://support.sw.siemens.com/\\\"\u003eV14.1.0.14 or later version\u003c/a\u003e\u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.2: Update to \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://support.sw.siemens.com/\\\"\u003eV14.2.0.10 or later version\u003c/a\u003e\u003c/li\u003e\u003cli\u003eJT2Go: Update to \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://plm.sw.siemens.com/en-US/plmcomponents/jt/jt2go/\\\"\u003eV14.3.0.8 or later version\u003c/a\u003e\u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.3: Update to \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://support.sw.siemens.com/\\\"\u003eV14.3.0.8 or later version\u003c/a\u003e\u003c/li\u003e\u003cli\u003eTeamcenter Visualization V2312: Update to \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://support.sw.siemens.com/\\\"\u003eV2312.0002 or later version\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\\nFor more information see the associated Siemens security advisory SSA-722010\\n\\n\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-722010.html\"}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-03\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To reduce risk, Siemens \\nrecommends users not open untrusted PDF files in affected applications.\\n\\n\\n\\n\\n\\n\\nAs a general security measure, Siemens recommends protecting network \\naccess to devices with appropriate mechanisms. To operate the devices in\\n a protected IT environment, Siemens recommends configuring the \\nenvironment according to  Siemens\u0027 operational guidelines for industrial security https://www.siemens.com/cert/operational-guidelines-industrial-security  and following recommendations in the product manuals.\\n\\n\\nAdditional information on industrial security by Siemens can be found on the  Siemens industrial security webpage https://www.siemens.com/industrialsecurity \\n\\nFor more information see the associated Siemens security advisory SSA-722010\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eTo reduce risk, Siemens \\nrecommends users not open untrusted PDF files in affected applications.\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\\n\u003c/ul\u003e\\n\u003cp\u003eAs a general security measure, Siemens recommends protecting network \\naccess to devices with appropriate mechanisms. To operate the devices in\\n a protected IT environment, Siemens recommends configuring the \\nenvironment according to \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.siemens.com/cert/operational-guidelines-industrial-security\\\"\u003eSiemens\u0027 operational guidelines for industrial security\u003c/a\u003e and following recommendations in the product manuals.\u003c/p\u003e\\n\u003cp\u003eAdditional information on industrial security by Siemens can be found on the \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.siemens.com/industrialsecurity\\\"\u003eSiemens industrial security webpage\u003c/a\u003e\u003c/p\u003eFor more information see the associated Siemens security advisory SSA-722010\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The affected applications contain an out of bounds read past the end of \\nan allocated structure while parsing specially crafted PDF files. This \\ncould allow an attacker to execute code in the context of the current \\nprocess.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The affected applications contain an out of bounds read past the end of \\nan allocated structure while parsing specially crafted PDF files. This \\ncould allow an attacker to execute code in the context of the current \\nprocess.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2024-08-12T21:46:38.910Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-7066\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-27T20:42:53.230Z\", \"dateReserved\": \"2023-12-21T19:40:53.933Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2024-08-12T21:46:38.910Z\", \"assignerShortName\": \"icscert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.