PT-2022-10369 · Xinje · Xinje Xd/E Series Plc Program Tool

Mashav Sapir · Published 2022-05-11 · Updated 2022-05-19 · CVE-2021-34605

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XINJE XD/E Series PLC Program Tool versions up to v3.5.1

Description A zip slip vulnerability can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This issue can be triggered by manually opening an infected project file or by initiating an upload program request from an infected Xinje PLC, potentially resulting in remote code execution, information disclosure, and denial of service of the system running the XINJE XD/E Series PLC Program Tool.

Recommendations For XINJE XD/E Series PLC Program Tool versions up to v3.5.1, update to a version later than v3.5.1 to resolve the issue. As a temporary workaround, consider avoiding the use of potentially infected project files and restricting upload program requests from untrusted Xinje PLC devices.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2021-34605

Affected Products

Xinje Xd/E Series Plc Program Tool

References · 4

• 🔥 https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-34605 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34605 · Vendor Advisory
• https://t.me/cvenotify/30031 · Telegram Post