CVE-2021-21825
A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remo...
Affects 2 products across 2 vendors.
Buffer overflow corrupting dynamically allocated heap memory, exploitable for arbitrary code execution.
Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A heap-based buffer overflow vulnerability in AT&T Labs’ Xmill 0.7 can be exploited via a specially crafted XMI file, leading to remote code execution. This vulnerability has a CVSS score of 9.8, indicating a critical severity level. Affected vendors include AT&T, Schneider-Electric, and Wolfram Schneider. No public proof of concept or known exploits are available, and the EPSS score suggests a low likelihood of exploitation in the wild. However, due to the potential for remote code execution, immediate attention is required to mitigate this risk in ICS/OT environments.
BSID: BS-2021-GLOBAL-241397-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-21825?
What is the CVSS score for CVE-2021-21825?
Is CVE-2021-21825 actively exploited?
How do I remediate CVE-2021-21825?
What systems are affected by CVE-2021-21825?
What NERC-CIP standard applies to CVE-2021-21825?
What IEC 62443 requirement maps to CVE-2021-21825?
| CVE ID | CVE-2021-21825 |
|---|---|
| BSID | BS-2021-GLOBAL-241397-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2021-08-18 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem function of AT&T Labs’ Xmill 0.7. An attacker can provide a specially crafted XMI file to trigger a heap-based buffer overflow, potentially leading to remote code execution. The attack can be performed remotely without any user interaction or authentication, making it highly dangerous in networked environments.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Att | Xmill | 0.7 |
| Schneider-Electric | Ecostruxure Process Expert | < 2021 |
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict input validation and file integrity checks for XMI files before processing. Ensure that all XMI files are sanitized and validated against a known good schema to prevent malicious content from being processed.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it involves a vulnerability that could allow an attacker to execute arbitrary code on a critical asset, compromising the security and reliability of the system.
This CVE maps to SR 7.6 because it involves a vulnerability that could be exploited to execute arbitrary code, which is a significant risk to the security and integrity of the ICS/OT environment.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | eb06458fa1b0453ec0223d858a524d70cf421407192ded0d75499e5982ea4a6d6b108bd554799688f06c3f554e78cc30957575cb43280c59885aedef2065fb1a |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →