PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-41902 Siemens CVE debrief

A stack-based buffer overflow vulnerability exists in Siemens JT2Go, triggered when parsing specially crafted PDF files. Successful exploitation allows code execution in the context of the current process. The vulnerability was disclosed on October 8, 2024, with a vendor fix available in version V2406.0003 or later. CISA and Siemens have published coordinated advisories with mitigation guidance and patch information.

Vendor
Siemens
Product
JT2Go
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-10-08
Original CVE updated
2025-05-06
Advisory published
2024-10-08
Advisory updated
2025-05-06

Who should care

Organizations using Siemens JT2Go for 3D visualization in engineering, manufacturing, or industrial environments should prioritize patching. Security teams in OT/ICS environments should assess exposure and apply mitigations where patching is delayed.

Technical summary

CVE-2024-41902 is a stack-based buffer overflow vulnerability in Siemens JT2Go, a visualization application for 3D JT data. The flaw exists in the PDF parsing component and can be triggered when the application processes a maliciously crafted PDF file. Successful exploitation results in arbitrary code execution within the context of the current process. The vulnerability has a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low attack complexity, no privileges required, and user interaction required. Siemens has released version V2406.0003 to remediate this issue. CISA published advisory ICSA-24-284-07 on October 8, 2024, with an update on May 6, 2025.

Defensive priority

HIGH

Recommended defensive actions

  • Update Siemens JT2Go to version V2406.0003 or later to address the vulnerability
  • If immediate patching is not feasible, remove PDFJTExtractor.exe from the installation directory as a temporary mitigation
  • Implement user training to avoid opening untrusted PDF files in affected applications
  • Apply defense-in-depth strategies for industrial control systems environments per CISA guidance
  • Monitor for suspicious PDF file handling activity in JT2Go deployments

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSA-24-284-07 and Siemens security advisory SSA-626178. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms local attack vector with high impact on confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-41902 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-41902

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-41902 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-41902

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-284-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-626178.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-626178.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.