CVE-2021-34605
📋 TL;DR
This zip slip vulnerability in XINJE XD/E Series PLC Program Tool allows attackers to write arbitrary files when opening malicious project files or receiving uploads from infected PLCs. This can lead to remote code execution, data theft, or system crashes. Organizations using XINJE PLC programming software up to v3.5.1 are affected.
💻 Affected Systems
- XINJE XD/E Series PLC Program Tool
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to PLC manipulation, industrial process disruption, and lateral movement to other systems.
Likely Case
Local file system compromise leading to data exfiltration or denial of service on the engineering workstation.
If Mitigated
Limited impact if proper network segmentation and file validation are implemented, potentially only affecting isolated engineering stations.
🎯 Exploit Status
Exploitation requires user interaction but has been publicly documented with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.5.2 or later
Vendor Advisory: https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/
Restart Required: Yes
Instructions:
1. Download latest version from XINJE official website. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Restrict project file sources
allOnly open project files from trusted sources and validate file integrity before opening.
Network segmentation
allIsolate PLC programming stations from general network and internet access.
🧯 If You Can't Patch
- Implement strict file validation procedures for all project files
- Segment PLC programming stations and restrict user privileges
🔍 How to Verify
Check if Vulnerable:
Check software version in Help > About menu. If version is 3.5.1 or earlier, system is vulnerable.Check Version:
Check via GUI: Help > About in XINJE PLC Program ToolVerify Fix Applied:
Verify version is 3.5.2 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- Multiple failed project file openings
- Unexpected PLC upload requests
Network Indicators:
- Unusual network traffic from PLC programming stations
- Unexpected file transfers to/from PLCs
SIEM Query:
EventID=4688 AND ProcessName LIKE '%XINJE%' AND CommandLine LIKE '%.xdp%'