{"id":25299,"date":"2026-07-14T07:57:07","date_gmt":"2026-07-14T05:57:07","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=25299"},"modified":"2026-07-14T08:00:02","modified_gmt":"2026-07-14T06:00:02","slug":"usd-2025-44","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-44\/","title":{"rendered":"usd-2025-44"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.7\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n

usd-2025-44 | EcoStruxure Building Operation - WorkStation 7.0.2.348 - XML Entity Expansion (Billion Laughs Attack)<\/h1>\n

<\/h1>\n

Product<\/strong>: EcoStruxure Building Operation - WorkStation
Affected Version<\/strong>: 7.0.2.348
Vulnerability Type<\/strong>: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (CWE-776)
Security Risk<\/strong>: MEDIUM
Vendor<\/strong>: Schneider Electric
Vendor URL<\/strong>: https:\/\/ecostruxure-building-help.se.com\/bms\/topics\/show.castle?id=8064&locale=en-US&productversion=7.0<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: CVE-2026-1227<\/a>
CVE Link<\/strong>: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-1227
Advisory ID<\/strong>: usd-2025-44<\/p>\n

Description<\/h3>\n

The XML interpreter allows the recursive resolution of arbitrary XML entities.<\/p>\n

The XML specification allows the definition of entities that can reference other entities within the same document.
When the XML parser processes such documents, it must resolve these references recursively, which can result in an exponential increase in resource consumption depending on the level of recursion.<\/p>\n

As a result, even a short XML message can cause an excessively high load on the server.
Attackers may exploit this behavior to perform a denial of service (DoS) attack without the need for extensive resources or infrastructure.<\/p>\n

Proof of Concept<\/h3>\n

The tgml-viewer accepts malicious Graphics in TGML<\/strong> format with XML including DTD\/ENTITY declarations.
In the following excerpt, a specially crafted TGML<\/strong> document is shown:<\/p>\n

<?xml version=\"1.0\"?>
<!DOCTYPE tgml
 [
  <!-- 1. Internal entity -->
  <!ENTITY a3 \"hello\" >
  <!ENTITY a4 \"&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;\">
]>
<?tgml version=\"2.0\"?>
<Tgml Background=\"#E0E0E0\" ComponentCounter=\"4\" GridSize=\"10\">
  <!-- XEE Test -->
  <Text FontFamily=\"Arial\" FontSize=\"20\" FontStyle=\"Normal\"
        FontWeight=\"Normal\" HorizontalAlign=\"Left\" Left=\"0.0\"
        Opacity=\"1.0\" TextDecoration=\"None\" Top=\"40.0\"
        VerticalAlign=\"Top\">
    XEE Test: &a4;
  <\/Text>
<\/Tgml><\/pre>\n
A new graphic was created using the malicious TGML document:<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
When inspecting the newly created Graphic in WorkStation, it is evident that the entity expansion was successful.
The following excerpt proves this:<\/p>\n
\"\"<\/p>\n