Description
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could
cause information disclosure, impacts workstation integrity and potential remote code execution on the
compromised computer, when specific crafted XML file is imported in the Web Designer configuration tool.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Web Designer for BMXNOR0200H | All versions | — |
| Schneider Electric | Web Designer for BMXNOE0110(H) | All versions | — |
| Schneider Electric | Web Designer for BMENOC0311(C) | All Versions | — |
| Schneider Electric | Web Designer for BMENOC0321(C) | All Versions | — |
Advisories 2
- ICSA-25-035-05 Schneider Electric Web Designer for Modicon CISA ICS & IT advisories · Feb 4, 2025
- SEVD-2025-014-04 Web Designer for Modicon Communication Modules Schneider Electric CPCERT · Jan 14, 2025