PatchSiren cyber security CVE debrief

CVE-2024-34086 Siemens CVE debrief

CVE-2024-34086 is a high-severity out-of-bounds write vulnerability in Siemens JT2Go and Teamcenter Visualization products, published on 2024-05-14. The flaw occurs when parsing specially crafted CGM (Computer Graphics Metafile) files, potentially allowing attackers to execute arbitrary code within the context of the current process. The vulnerability affects JT2Go and multiple versions of Teamcenter Visualization (V14.1, V14.2, V14.3, and V2312). Siemens has released patched versions for all affected products, and CISA has issued advisory ICSA-24-137-03 coordinating the disclosure. The attack requires local access with user interaction, as victims must open a malicious CGM file. Organizations should prioritize updating to the fixed versions and implement user awareness training about opening untrusted files.

Vendor: Siemens
Product: JT2Go
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-05-14
Original CVE updated: 2024-05-14
Advisory published: 2024-05-14
Advisory updated: 2024-05-14

Who should care

Organizations using Siemens JT2Go or Teamcenter Visualization for CAD/CAM/CAE workflows, particularly in industrial control system (ICS) environments where these tools are used for design review and technical documentation. Engineering workstations with access to OT networks are high-value targets requiring prioritized patching.

Technical summary

The vulnerability exists in the CGM file parsing component of affected Siemens visualization applications. A malformed CGM file can trigger an out-of-bounds write condition, leading to memory corruption. Successful exploitation allows code execution with the privileges of the user running the application. The attack surface is limited by the requirement for user interaction to open a malicious file, but the impact is severe given the high privileges typically associated with engineering workstations in industrial environments.

Defensive priority

HIGH

Recommended defensive actions

Update JT2Go to V2312.0001 or later version
Update Teamcenter Visualization V14.1 to V14.1.0.13 or later
Update Teamcenter Visualization V14.2 to V14.2.0.10 or later
Update Teamcenter Visualization V14.3 to V14.3.0.7 or later
Update Teamcenter Visualization V2312 to V2312.0001 or later
Train users not to open untrusted CGM files in affected applications
Apply defense-in-depth controls for ICS environments per CISA guidance

Evidence notes

Vulnerability confirmed in CISA CSAF advisory ICSA-24-137-03 with Siemens SSA-661579 as primary technical source. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local attack vector requiring user interaction but resulting in complete confidentiality, integrity, and availability compromise.

Sources and references

Verified primary and authoritative sources

CVE-2024-34086 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-34086

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-34086 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-34086

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-137-03.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-661579.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-661579.html

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/pdf/ssa-661579.pdf

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/txt/ssa-661579.txt

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-137-03

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.