CVE-2023-33122

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-13 · updated 2026-10-24
Weakness: CWE-125

Description

A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions < V14.0.0.6), Teamcenter Visualization V14.1 (All versions < V14.1.0.8), Teamcenter Visualization V14.2 (All versions < V14.2.0.3). The affected applications contain an out of bounds read past the end of an allocated buffer while parsing a specially crafted CGM file. This vulnerability could allow an attacker to disclose sensitive information.

Affected products

Siemens JT2Go: before 14.2.0.3 — fixed in 14.2.0.3
Siemens Teamcenter Visualization: from 13.2.0 before 13.2.0.13; from 13.3.0 before 13.3.0.10; from 14.0 before 14.0.0.6; from 14.1 before 14.1.0.8; from 14.2 before 14.2.0.3 — fixed in 13.2.0.13, 13.3.0.10, 14.0.0.6, 14.1.0.8, 14.2.0.3

How to fix

Upgrade to a fixed version: Siemens JT2Go 14.2.0.3; Siemens Teamcenter Visualization 13.2.0.13, 13.3.0.10, 14.0.0.6, 14.1.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-33122 or the next vulnerability affects your stack