CVE-2021-38405

Solution:

• Siemens has released updates for some of the affected products and recommends updating to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not yet available. * JT2Go: Update to v13.2.0.7 https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html  or later version * Teamcenter Visualization v13.1: Update to v13.1.0.9 or later version https://support.sw.siemens.com/ * Teamcenter Visualization v13.2: Update to v13.2.0.7 or later version https://support.sw.siemens.com/ * Teamcenter Visualization v13.3: Update to v13.3.0.1 or later version https://support.sw.siemens.com/ Please see Siemens security advisory SSA-301589 https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf  for more information.

Workaround:

• Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk: * Avoid opening untrusted files from unknown sources in affected products. As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf , and to follow the recommendations in the product manuals. Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage https://www.siemens.com/industrialsecurity . Please see Siemens security advisory SSA-301589 https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf  for more information.