In WECON Technology Co., Ltd.

Published 8 y ago 2018-10-08 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.3

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.2%

percentile 69%

Public exploits

none known

In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the XMLParser that ships with Wecon PIStudio is vulnerable to a XML external entity injection attack, which may allow sensitive information disclosure.

Exploit prediction (EPSS)

1.25% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.3	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`

Affected products

WECON PI Studio HMI
WECON PI Studio

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

ics-cert.us-cert.gov /advisories/ICSA-18-277-01 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2018-17889
NVD: CVE-2018-17889

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.