CVE-2021-34605CWE-23

Xinje XD/E Series PLC Program Tool Zip Slip

High · published May 11, 2022

CVSS v3.1
7.3
EPSS
3%
Percentile
85.3
In the wild
Unconfirmed
What it is

A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02621 · 85.3th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2022-05-11T14:25Z
EPSS history
Timeline
  • 11 MAY 14:25Z
    Xinje XD/E Series PLC Program Tool Zip Slip
    cvelistv5