Read the docs
TI-2021-12581 Aliases CVE-2021-32972GHSA-5cr4-4crm-rrp5

XML external entity injection in Panasonic FPWIN Pro

Priority LOW 26CWE-611Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.

Why it matters now

EPSS 0.00695 53rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Panasonic FPWIN Proup to 7.5.1.1—No fix listedCNA
  • Panasonic FPWIN Pro Vendor— Affected up to 7.5.1.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:panasonic:fpwin_pro:*:*:*:*:*:*:*:*up to 7.5.1.1VulnerablePanasonic
  • cpe:2.3:a:panasonic:fpwin_pro:*:*:*:*:*:*:*:* Versions up to 7.5.1.1 Vulnerable ·Panasonic

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32972
  2. 2026-10-03 Alias added: GHSA-5cr4-4crm-rrp5

References

Advisory 1

  • TI-2020-12765 anasonic FPWIN Pro CVSS 3.1HIGH 7.8
  • TI-2023-05798 Out-of-bounds read in Panasonic Control FPWIN Pro CVSS 3.1HIGH 7.8
  • TI-2023-05797 Out-of-bounds write in Panasonic Control FPWIN Pro CVSS 3.1HIGH 7.8
  • TI-2016-03869 Panasonic FPWIN Pro 5.x through 7.x before 7.130 accesses an uninitialized pointer, which… CVSS 3.0MEDIUM 5.5
  • TI-2016-03870 Heap-based buffer overflow in Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows… CVSS 3.0MEDIUM 4.2
  • TI-2016-03868 Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows local users to cause a denial of… CVSS 3.0MEDIUM 4.2
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences