CVE-2022-26507

Published: Apr 14, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This is not the same as any of: CVE-2021-21810, CVE-2021-21811, CVE-2021-21812, CVE-2021-21815, CVE-2021-21825, CVE-2021-21826, CVE-2021-21828, CVE-2021-21829, or CVE-2021-21830. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected (5)

Products: Att: Xmill · Schneider Electric: Ecostruxure Control Expert, Ecostruxure Process Expert, Remoteconnect

Att

1 product

Xmill

Schneider Electric

3 products

Ecostruxure Control Expert

Ecostruxure Process Expert

Remoteconnect

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Att Xmill	Version 0.7

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Ecostruxure Control Expert	Before 15.1
Schneider Electric Ecostruxure Control Expert	Version 15.1
Schneider Electric Ecostruxure Process Expert	Before 2021

Configuration C

1 vulnerable · 5 platform

Vulnerable Software	Affected Versions
Schneider Electric Remoteconnect	All versions

Running on/with	Platform Versions
Schneider Electric Scadapack 470	All versions
Schneider Electric Scadapack 474	All versions
Schneider Electric Scadapack 570	All versions
Schneider Electric Scadapack 574	All versions
Schneider Electric Scadapack 575	All versions