This feature, while convenient, can also be exploited if an attacker obtains access to this password list.
As detailed above, this DLL hijacking vulnerability allows local attackers to execute arbitrary code. It requires local access and sufficient file-write privileges.
Downloading and executing unauthorized PLC password cracking software poses substantial threats to both your IT infrastructure and physical machinery.
: An attacker places a specially crafted project file on a shared network drive or sends it to an engineer. xinje plc password crack 2021
If you are locked out of a Xinje PLC, prioritize authorized, legal methods to regain access:
If you are considering using such a tool, it is important to weigh the technical risks against the intended goal:
Xinje PLC, taking a proactive approach, publicly acknowledged the breach and thanked the hackers for their "white-hat" efforts. The company subsequently patched the vulnerability and upgraded its security protocols. This feature, while convenient, can also be exploited
In 2021, concerns emerged about the security of Xinjie PLC devices, specifically related to password cracking. Password cracking refers to the process of guessing or recovering a password to gain unauthorized access to a system. In the context of PLCs, a cracked password could allow an attacker to manipulate the device, access sensitive data, or disrupt industrial processes.
First send: 01 01 74 02 00 01 47 FA Then send: 01 03 44 54 00 01 D1 2A Finally send: 01 03 44 0A 00 03 31 39
Allows an attacker to manipulate project files and write unauthorized logic directly to the PLC. Remote Code Execution To this day
7.3 (High)
Exploiting Vulnerabilities in XINJE PLC Program Tool | Claroty
Because the vendor refused to provide a patch at the time, the Cybersecurity and Infrastructure Security Agency (CISA) eventually stepped in to issue a public advisory. To this day, many older versions of the Xinje XD/E series remain vulnerable unless users follow manual mitigation steps like isolating their control networks from the internet.