Vulnerability · Published May 11, 2022 · Assigned by CERTVDE

CVE-2021-34605Xinje XD/E Series PLC Program Tool Zip Slip

High 7.3

In plain English

A high-severity security flaw in XD/E Series PLC Program Tool from XINJE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)2.6%top 14.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool.

Affected products (as reported)

Vendor	Product	Versions
XINJE	XD/E Series PLC Program Tool	unspecified – through v3.5.1

Weakness: CWE-23 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/ x_refsource_CONFIRM