TI-2023-14606 Aliases CVE-2023-30796 GHSA-5gf4-2rx5-gfrc

Out-of-bounds read in Siemens JT Open

LOW 35CWE-125Published 2023-08-08 · Updated 2024-10-11

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00217 12th percentileScored 2026-11-07

Fix Fixed JT Open (Siemens): V11.4JT Utilities (Siemens): V13.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	JT Open	before V11.4	V11.4	Patch available	CNA
Siemens	JT Utilities	before V13.4	V13.4	Patch available	CNA

JT Open VendorSiemens Affected before V11.4 Fixed in V11.4 Patch available CNA
JT Utilities VendorSiemens Affected before V13.4 Fixed in V13.4 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:jt_open_toolkit::::::::	before 11.4	Vulnerable	Siemens
cpe:2.3:a:siemens:jt_utilities::::::::	before 13.4	Vulnerable	Siemens

cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:* Versions before 11.4 Vulnerable ·Siemens
cpe:2.3:a:siemens:jt_utilities:*:*:*:*:*:*:*:* Versions before 13.4 Vulnerable ·Siemens

Remediation

Fix · CNA JT Open (Siemens) Fixed in V11.4
Fix · CNA JT Utilities (Siemens) Fixed in V13.4

Timeline

2026-10-02 Threatist record created from CVE-2023-30796
2026-10-03 Alias added: GHSA-5gf4-2rx5-gfrc

References

Advisory 1

https://cert-portal.siemens.com/productcert/pdf/ssa-001569.pdf

TI-2021-19766 Use after free in Siemens JT Open CVSS 3.1HIGH 7.8
TI-2021-19754 Out-of-bounds write in Siemens JT Open CVSS 3.1HIGH 7.8
TI-2022-23749 Memory corruption in Siemens JT Open CVSS 3.1HIGH 7.8
TI-2022-20204 A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap… CVSS 3.1HIGH 7.8
TI-2021-20063 Out-of-bounds write in Siemens JT Utilities CVSS 3.1HIGH 7.8
TI-2021-20061 Use after free in Siemens JT Utilities CVSS 3.1HIGH 7.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences