Vulnerability Description
A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and sufficient file-write privileges. If exploited, the attacker could place a malicious DLL file on the system, that when running XINJE XD/E Series PLC Program Tool will allow the attacker to execute arbitrary code with the privileges of another user's account.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xinje | Xd\/E Series Plc Program Tool | <= 3.5.1 |
Related Weaknesses (CWE)
References
- https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-executionExploitThird Party Advisory
- https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-executionExploitThird Party Advisory
FAQ
What is CVE-2021-34606?
CVE-2021-34606 is a vulnerability with a CVSS score of 7.3 (HIGH). A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully ...
How severe is CVE-2021-34606?
CVE-2021-34606 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-34606?
Check the references section above for vendor advisories and patch information. Affected products include: Xinje Xd\/E Series Plc Program Tool.