PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-34086 Siemens CVE debrief

CVE-2024-34086 is a high-severity out-of-bounds write vulnerability in Siemens JT2Go and Teamcenter Visualization products, published on 2024-05-14. The flaw occurs when parsing specially crafted CGM (Computer Graphics Metafile) files, potentially allowing attackers to execute arbitrary code within the context of the current process. The vulnerability affects JT2Go and multiple versions of Teamcenter Visualization (V14.1, V14.2, V14.3, and V2312). Siemens has released patched versions for all affected products, and CISA has issued advisory ICSA-24-137-03 coordinating the disclosure. The attack requires local access with user interaction, as victims must open a malicious CGM file. Organizations should prioritize updating to the fixed versions and implement user awareness training about opening untrusted files.

Vendor
Siemens
Product
JT2Go
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-14
Original CVE updated
2024-05-14
Advisory published
2024-05-14
Advisory updated
2024-05-14

Who should care

Organizations using Siemens JT2Go or Teamcenter Visualization for CAD/CAM/CAE workflows, particularly in industrial control system (ICS) environments where these tools are used for design review and technical documentation. Engineering workstations with access to OT networks are high-value targets requiring prioritized patching.

Technical summary

The vulnerability exists in the CGM file parsing component of affected Siemens visualization applications. A malformed CGM file can trigger an out-of-bounds write condition, leading to memory corruption. Successful exploitation allows code execution with the privileges of the user running the application. The attack surface is limited by the requirement for user interaction to open a malicious file, but the impact is severe given the high privileges typically associated with engineering workstations in industrial environments.

Defensive priority

HIGH

Recommended defensive actions

  • Update JT2Go to V2312.0001 or later version
  • Update Teamcenter Visualization V14.1 to V14.1.0.13 or later
  • Update Teamcenter Visualization V14.2 to V14.2.0.10 or later
  • Update Teamcenter Visualization V14.3 to V14.3.0.7 or later
  • Update Teamcenter Visualization V2312 to V2312.0001 or later
  • Train users not to open untrusted CGM files in affected applications
  • Apply defense-in-depth controls for ICS environments per CISA guidance

Evidence notes

Vulnerability confirmed in CISA CSAF advisory ICSA-24-137-03 with Siemens SSA-661579 as primary technical source. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local attack vector requiring user interaction but resulting in complete confidentiality, integrity, and availability compromise.

Official resources

Coordinated disclosure via CISA ICS advisory ICSA-24-137-03 and Siemens ProductCERT