XINJE XD

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Low attack complexity/public exploits are available Vendor: XINJE Equipment: XINJE XD Programing Tool Vulnerabilities: Relative Path Traversal, Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

CVE-2021-34606

A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and...

Design/Logic Flaw

A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and...

Information disclosure

A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an uplo...

CVE-2021-34606 XINJE XD/E Series PLC Program Tool DLL Hijacking

A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and...

CVE-2021-34606

CVE-2021-34606 affects XINJE XD/E Series PLC Program Tool up to version 3.5.1. The issue is due to an Uncontrolled Search Path Element (DLL hijacking) that could allow an authenticated, local attacker with file-write privileges to place a malicious DLL and cause arbitrary code execution with the ...

CVE-2021-34605

CVE-2021-34605 affects XINJE XD/E Series PLC Program Tool up to version 3.5.1. A zip-slip flaw in handling a crafted project file could grant arbitrary file write, potentially enabling remote code execution, information disclosure and DoS on the tool. Affected path includes opening a malicious pr...