CVE-2023-33121

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-13 · updated 2026-10-24
Weakness: CWE-476

Description

A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions < V14.0.0.6), Teamcenter Visualization V14.1 (All versions < V14.1.0.8), Teamcenter Visualization V14.2 (All versions < V14.2.0.3). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.

Affected products

Siemens JT2Go: before 14.2.0.3 — fixed in 14.2.0.3
Siemens Teamcenter Visualization: before 13.2.0.13; from 13.3.0 before 13.3.0.10; from 14.0 before 14.0.0.6; from 14.1 before 14.1.0.8; from 14.2 before 14.2.0.3 — fixed in 13.2.0.13, 13.3.0.10, 14.0.0.6, 14.1.0.8, 14.2.0.3

How to fix

Upgrade to a fixed version: Siemens JT2Go 14.2.0.3; Siemens Teamcenter Visualization 13.2.0.13, 13.3.0.10, 14.0.0.6, 14.1.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-33121 or the next vulnerability affects your stack