Vulnerability Spotlight: Multiple vulnerabilities in AT&T Labs’ Xmill utility

Summary: Cisco Talos discovered multiple vulnerabilities in AT&T Labs' Xmill XML compression utility, including memory corruption flaws TALOS-2021-1278 (CVE-2021-21810) and TALOS-2021-1279 (CVE-2021-21811) and heap-based buffer overflows tracked as TALOS-2021-1290 through TALOS-2021-1293, which could let an attacker execute code on a victim machine. AT&T Labs no longer supports the software, released in 1999, and will not issue patches, though the utility still appears in modern suites such as Schneider Electric's EcoStruxure Control Expert, which Schneider is working to fix.
Bottom line: The vulnerable code dates to 1999 and its original vendor has walked away, so the only patch path runs through Schneider Electric for the subset of flaws affecting EcoStruxure Control Expert - leaving anyone else running Xmill 0.7 with no fix at all.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-21810 CVE-2021-21811 CVE-2021-21812 CVE-2021-21815 CVE-2021-21825 CVE-2021-21826 CVE-2021-21828 CVE-2021-21829 CVE-2021-21830
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026