medium5.5Public exploit code
CVE-2018-10832
ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ModbusPal 1.6b - XML External Entity Injection2018-05-10 · webapps · java
Impact
ModbusPal 1.6b is vulnerable to an XML External Entity (XXE) attack. Projects are saved as .xmpp files and automations can be exported as .xmpa files, both XML-based, which are vulnerable to XXE injection. Sending a crafted .xmpp or .xmpa file to a user, when opened/imported in ModbusPal, will return the contents of any local files to a remote attacker.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Modbuspal Project | Modbuspal | Version 1.6 |