SB2025020540 - XML External Entity injection in Schneider Electric Web Designer for Modicon

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025020540

SB2025020540 - XML External Entity injection in Schneider Electric Web Designer for Modicon

Published: February 5, 2025

Security Bulletin ID SB2025020540
CSH Severity
High
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) XML External Entity injection (CVE-ID: CVE-2024-12476)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can use a specifically crafted XML file and view contents of arbitrary files on the system or initiate requests to external systems, leading to arbitrary code execution.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References