PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26276 Siemens CVE debrief

CVE-2024-26276 is a stack exhaustion vulnerability in Siemens JT2Go and Teamcenter Visualization products, published on June 11, 2024. The vulnerability occurs when parsing specially crafted X_T (Parasolid) files, allowing an attacker to cause a denial of service condition. The CVSS 3.1 score of 3.3 (Low severity) reflects the local attack vector and user interaction requirements. Affected products include JT2Go, Teamcenter Visualization V14.2, V14.3, and V2312. Siemens has released patched versions: V14.2.0.12, V14.3.0.9, and V2312.0004. As an interim mitigation, users should avoid opening untrusted XT files. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Siemens
Product
JT2Go
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2024-04-09
Advisory published
2024-04-09
Advisory updated
2024-04-09

Who should care

Organizations using Siemens JT2Go or Teamcenter Visualization for viewing CAD files, particularly in industrial and manufacturing environments where X_T file exchange is common. Security teams in OT/ICS environments should prioritize patching during scheduled maintenance windows.

Technical summary

A stack exhaustion vulnerability exists in Siemens JT2Go and Teamcenter Visualization products when parsing specially crafted X_T (Parasolid) files. The vulnerability is triggered during file parsing operations, leading to stack exhaustion and resulting in a denial of service condition. The attack requires local access and user interaction (opening a malicious file). The CVSS 3.1 score of 3.3 reflects AV:L (local attack vector), UI:R (user interaction required), and A:L (low availability impact). Siemens has addressed this in V14.2.0.12, V14.3.0.9, and V2312.0004.

Defensive priority

routine

Recommended defensive actions

  • Update JT2Go to version V2312.0004 or later
  • Update Teamcenter Visualization V14.2 to version V14.2.0.12 or later
  • Update Teamcenter Visualization V14.3 to version V14.3.0.9 or later
  • Update Teamcenter Visualization V2312 to version V2312.0004 or later
  • Avoid opening untrusted XT files in affected applications until patches can be applied
  • Apply defense-in-depth practices for industrial control systems environments

Evidence notes

The vulnerability description and affected products are sourced from CISA CSAF advisory ICSA-24-165-08. Remediation guidance including specific patched versions is documented in the CSAF remediation section. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) confirms local attack vector with user interaction required.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26276 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26276

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26276 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26276

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-08.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-771940.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-771940.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-08

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.