XINJE XD
A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 could provide an attacker with arbitrary file write privilege when opening a specially crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure, and denial-of-service of the system running the XINJE XD/E Series PLC Program Tool. -CVE-2021-34605 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that could allow an authenticated local attacker to load a malicious DLL. The potential attacker must have access to the system and sufficient file-write privileges to successfully exploit this vulnerability. If exploited, the attacker could place a malicious DLL file on the system, which could allow the attacker to execute arbitrary code with the privileges of another user's account when running the XINJE XD/E Series PLC Program Tool. -CVE-2021-34606 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). 