What’s Vulnerable › Vulnerabilities

CVE-2021-3252

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-23 · updated 2026-06-17
• Weakness: CWE-522

Description

KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability.

Affected products

• Kaco-Newenergy Xp100U Firmware: xp-java_2.0

References

• https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html
• https://twitter.com/Kevin2600/status/1351189347501023238
• https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01
• https://tiger-team-1337.blogspot.com/2021/01/kaco-xp100u-hmi-credential-leak.html
• https://twitter.com/Kevin2600/status/1351189347501023238
• https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-15-224-01

Get alerted when CVE-2021-3252 or the next vulnerability affects your stack