CVE-2021-34605
CVE-2021-34605 is a high-severity vulnerability in Xinje Xd/e Series Plc Program Tool with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-23.
Key facts
- Severity: High (CVSS 3.x base score 7.3)
- CVSS v2: 6.0
- EPSS exploit prediction: 2% (82nd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-23
- Affected product: Xinje Xd/e Series Plc Program Tool
- Published:
- Last modified:
Description
A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool.
Frequently asked questions
- What is CVE-2021-34605?
- A zip slip vulnerability in XINJE XD/E Series PLC Program Tool up to version v3.5.1 can provide an attacker with arbitrary file write privilege when opening a specially-crafted project file. This vulnerability can be triggered by manually opening an infected project file, or by initiating an upload program request from an infected Xinje PLC. This can result in remote code execution, information disclosure and denial of service of the system running the XINJE XD/E Series PLC Program Tool.
- How severe is CVE-2021-34605?
- CVE-2021-34605 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2021-34605 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-34605?
- CVE-2021-34605 affects Xinje Xd/e Series Plc Program Tool. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-34605?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2021-34605 published?
- CVE-2021-34605 was published on 2022-05-11 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:xinje:xd\/e_series_plc_program_tool:*:*:*:*:*:*:*:*
More vulnerabilities in Xinje Xd/e Series Plc Program Tool
- CVE-2021-34606 — High (CVSS 7.3): A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated,…
All CVEs affecting Xinje Xd/e Series Plc Program Tool →
Other CWE-23 vulnerabilities
- CVE-2026-52813 — Critical (CVSS 10.0): Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences…
- CVE-2026-8326 — Critical (CVSS 10.0): Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows reading and writing…
- CVE-2026-33494 — Critical (CVSS 10.0): ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based…
- CVE-2023-3941 — Critical (CVSS 10.0): Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system…
- CVE-2024-24578 — Critical (CVSS 10.0): RaspberryMatic is an open-source operating system for HomeMatic internet-of-things devices. RaspberryMatic / OCCU prior…
- CVE-2012-6069 — Critical (CVSS 10.0): The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an…