PT-2018-1636 · Wecon Technology · Pi Studio+1

Published 2018-10-02 · Updated 2019-10-09 · CVE-2018-17889

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior WECON Technology Co., Ltd. PI Studio versions 4.2.34 and prior

Description The issue is caused by incorrect restriction of XML links to external objects in the XML analyzer of PI Studio development tools. This may allow a remote attacker to disclose protected information. The XMLParser in WECON PIStudio is vulnerable to an XML external entity injection attack when parsing project files, potentially leading to sensitive information disclosure.

Recommendations For WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior: Update to a version later than 4.1.9 to resolve the issue. For WECON Technology Co., Ltd. PI Studio versions 4.2.34 and prior: Update to a version later than 4.2.34 to resolve the issue. As a temporary workaround, consider restricting access to the XMLParser until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2018-01195

CVE-2018-17889

ZDI-18-1106

Affected Products

Pi Studio

Pi Studio Hmi

References · 5

• https://zerodayinitiative.com/advisories/ZDI-18-1106 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17889 · Security Note
• https://bdu.fstec.ru/vul/2018-01195 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01 · Note