Skip to content
Fencer Vulns
high 7.3

CVE-2021-34606 json

XINJE XD/E Series PLC Program Tool DLL Hijacking

published 2022-05-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-21256

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and sufficient file-write privileges. If exploited, the attacker could place a malicious DLL file on the system, that when running XINJE XD/E Series PLC Program Tool will allow the attacker to execute arbitrary code with the privileges of another user's account.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-024-01 updated cvss 7.3

XINJE XD

  • XINJE XD Programing Tool <= 3.5.1
    affected: mitigation “Xinje has not responded to requests to provide mitigations for these vulnerabilities. Users of the affected product are encouraged to contact Xinje Technical Support.” en.xinje.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • claroty.com https://claroty.com/2022/05/11/blog-research-from-project-file-to-code-execution-exploiting-vulnerabilities-in-xinje-plc-program-tool/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • XINJE XD/E Series PLC Program Tool

Classification

Weakness
  • CWE-427 Uncontrolled Search Path Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.