Summary
Successful exploitation of these vulnerabilities could allow an attacker to write arbitrary project files to a programmable logic controller (PLC) and gain code execution privileges.
Vulnerabilities 2
-
High 7.3
Xinje XD/E Series PLC Program Tool Zip Slip
A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected …
-
High 7.3
XINJE XD/E Series PLC Program Tool DLL Hijacking
A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attack…
Revision history
-
#1
Publication Date
References
-
ICS Advisory ICSA-23-024-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-024-01
-
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf