LiveActive security incident?Get immediate response
CVE Record

CVE-2021-32972: Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying...

Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-32972 affects Panasonic FPWIN Pro 7.5.1.1 and earlier. A malicious project file could make the software fetch and embed external content through XML parsing, potentially exposing files or data available to the user who opens it.

Executive priority

Treat this as a targeted information-disclosure risk for engineering environments, not a broad internet-facing emergency. Prioritize organizations exchanging FPWIN Pro projects with third parties or storing sensitive operational files on engineering workstations.

Technical view

The issue is CWE-611, an XML external entity style flaw. The source describes crafted project files that specify a URI, causing the XML parser to access that URI and embed returned contents. Impact is information disclosure in the executing user's context.

Likely exposure

Exposure is likely limited to organizations using Panasonic FPWIN Pro, especially engineering or OT workstations that open project files from vendors, contractors, archives, or shared repositories.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation evidence. The described scenario requires a crafted project file and user-side processing by vulnerable FPWIN Pro software.

Researcher notes

Available evidence identifies product, version range, CWE-611 class, and information-disclosure impact. The bundle lacks CVSS details, exploit maturity, and specific vendor remediation text, so validation should focus on version inventory and project-file trust boundaries.

Mitigation direction

  • Identify FPWIN Pro installations and versions across engineering workstations.
  • Check Panasonic and CISA guidance for the fixed or recommended version.
  • Avoid opening FPWIN Pro project files from untrusted sources.
  • Restrict engineering workstation access to sensitive local files and network shares.
  • Use standard malware and file screening for received project files.

Validation and detection

  • Inventory FPWIN Pro versions and flag 7.5.1.1 or earlier.
  • Review how project files are received, stored, and trusted.
  • Confirm users handling external projects have least-privilege file access.
  • Check whether vendor remediation has been applied.
  • Monitor for suspicious external URI access from engineering workstations.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-611: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-32972 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aPanasonic FPWIN ProAll Versions 7.5.1.1 and priorListed
Weakness

CWE details

CWE-611

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-611 · source CWE mapping

Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs