CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5463 – XINJE XDPPro cfgmgr32.dll uncontrolled search path
https://notcve.org/view.php?id=CVE-2023-5463
09 Oct 2023 — A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfgmgr32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. • https://drive.google.com/drive/folders/1mpRxWOPjxVS980r0qu1IY_Hf0irKO-cu • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-5462 – XINJE XD5E-30R-E Modbus denial of service
https://notcve.org/view.php?id=CVE-2023-5462
09 Oct 2023 — A vulnerability was found in XINJE XD5E-30R-E 3.5.3b. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Modbus Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. • https://drive.google.com/drive/folders/1jik8hRjD8N2IkxOHP5wsJUEya09jCv2n • CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-34606 – XINJE XD/E Series PLC Program Tool DLL Hijacking
https://notcve.org/view.php?id=CVE-2021-34606
11 May 2022 — A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and sufficient file-write privileges. If exploited, the attacker could place a malicious DLL file on the system, that when running XINJE XD/E Series PLC Program Tool will allow the attacker to execute arbitrary code wit... • https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-34605 – Xinje XD/E Series PLC Program Tool Zip Slip
https://notcve.org/view.php?id=CVE-2021-34605
11 May 2022 — A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool. Una vulnerabilidad ... • https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool • CWE-23: Relative Path Traversal •