CVE-2021-21810
A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can prov...
Affects 2 products across 2 vendors.
Buffer overflow corrupting dynamically allocated heap memory, exploitable for arbitrary code execution.
Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A memory corruption vulnerability in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7 can lead to a heap buffer overflow, potentially allowing an attacker to execute arbitrary code. This vulnerability has a CVSS score of 9.8, indicating a critical severity level. Affected vendors include AT&T, Schneider-Electric, and Wolfram Schneider. No public proof of concept or known exploits are available, and the EPSS score is low, suggesting a minimal likelihood of exploitation in the wild. However, due to the critical nature of the vulnerability, immediate attention is required to mitigate potential risks in ICS/OT environments.
BSID: BS-2021-GLOBAL-075762-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-21810?
What is the CVSS score for CVE-2021-21810?
Is CVE-2021-21810 actively exploited?
How do I remediate CVE-2021-21810?
What systems are affected by CVE-2021-21810?
What NERC-CIP standard applies to CVE-2021-21810?
What IEC 62443 requirement maps to CVE-2021-21810?
| CVE ID | CVE-2021-21810 |
|---|---|
| BSID | BS-2021-GLOBAL-075762-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2021-08-17 |
| Last Modified | 2024-11-21 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Source: NIST NVD / MITRE CVE Database
The vulnerability can be triggered by providing a specially crafted XML file to the affected Xmill 0.7 application. The heap buffer overflow can lead to memory corruption, potentially allowing an attacker to execute arbitrary code. The attack can be performed remotely without authentication, making it highly dangerous in networked environments.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Att | Xmill | 0.7 |
| Schneider-Electric | Ecostruxure Process Expert | < 2021 |
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict input validation and sanitization for XML files processed by Xmill 0.7. Consider using a secure XML parser that is less susceptible to buffer overflow attacks.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This vulnerability violates CIP-007-R2, which requires the implementation of security controls to protect against unauthorized access and malicious activity. The heap buffer overflow can be exploited to gain unauthorized access and execute arbitrary code, compromising the security of the system.
This vulnerability maps to SR 7.6, which requires the implementation of secure coding practices to prevent common software vulnerabilities. The heap buffer overflow is a result of insecure coding practices and can be mitigated by following secure coding guidelines.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 207507fd00aedca3080fffc66735b88038aac7946d4a5ffca5c2d2a43b58330340fa3d1f4fedadb83b41a294d3839dba60c414474b079807f6f172e3f87610bd |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →