Lucene search

Hitachi EnergyCVE-2021-35530

HistoryJun 07, 2022 - 9:15 p.m.

CVE-2021-35530

2022-06-0721:15:14

CWE-288

Hitachi Energy

web.nvd.nist.gov

vulnerability

hitachi energy

txpert hub coretec 4

unauthorized access

password change

nvd

cve-2021-35530

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

Percentile

12.6%

JSON

A vulnerability in the application authentication and authorization mechanism in Hitachi Energy’s TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

Affected configurations

Nvd

Node

hitachienergytxpert_hub_coretec_4_firmwareMatch2.0.0

hitachienergytxpert_hub_coretec_4_firmwareMatch2.0.1

hitachienergytxpert_hub_coretec_4_firmwareMatch2.1.0

hitachienergytxpert_hub_coretec_4_firmwareMatch2.1.1

hitachienergytxpert_hub_coretec_4_firmwareMatch2.1.2

hitachienergytxpert_hub_coretec_4_firmwareMatch2.1.3

hitachienergytxpert_hub_coretec_4_firmwareMatch2.2.0

hitachienergytxpert_hub_coretec_4_firmwareMatch2.2.1

AND

hitachienergytxpert_hub_coretec_4Match-

VendorProductVersionCPE
hitachienergytxpert_hub_coretec_4_firmware2.0.0cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.0:*:*:*:*:*:*:*
hitachienergytxpert_hub_coretec_4_firmware2.0.1cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.1:*:*:*:*:*:*:*
hitachienergytxpert_hub_coretec_4_firmware2.1.0cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.0:*:*:*:*:*:*:*
hitachienergytxpert_hub_coretec_4_firmware2.1.1cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.1:*:*:*:*:*:*:*
hitachienergytxpert_hub_coretec_4_firmware2.1.2cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.2:*:*:*:*:*:*:*
hitachienergytxpert_hub_coretec_4_firmware2.1.3cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.3:*:*:*:*:*:*:*
hitachienergytxpert_hub_coretec_4_firmware2.2.0cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.0:*:*:*:*:*:*:*
hitachienergytxpert_hub_coretec_4_firmware2.2.1cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.1:*:*:*:*:*:*:*
hitachienergytxpert_hub_coretec_4-cpe:2.3:h:hitachienergy:txpert_hub_coretec_4:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hitachienergy	txpert_hub_coretec_4_firmware	2.0.0	cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.0:::::::*
hitachienergy	txpert_hub_coretec_4_firmware	2.0.1	cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.1:::::::*
hitachienergy	txpert_hub_coretec_4_firmware	2.1.0	cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.0:::::::*
hitachienergy	txpert_hub_coretec_4_firmware	2.1.1	cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.1:::::::*
hitachienergy	txpert_hub_coretec_4_firmware	2.1.2	cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.2:::::::*
hitachienergy	txpert_hub_coretec_4_firmware	2.1.3	cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.3:::::::*
hitachienergy	txpert_hub_coretec_4_firmware	2.2.0	cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.0:::::::*
hitachienergy	txpert_hub_coretec_4_firmware	2.2.1	cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.1:::::::*
hitachienergy	txpert_hub_coretec_4	-	cpe:2.3:h:hitachienergy:txpert_hub_coretec_4:-:::::::*

CNA Affected

[
  {
    "product": "TXpert Hub CoreTec 4 version",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.0"
      },
      {
        "status": "affected",
        "version": "2.0.1"
      },
      {
        "status": "affected",
        "version": "2.1.0"
      },
      {
        "status": "affected",
        "version": "2.1.1"
      },
      {
        "status": "affected",
        "version": "2.1.2"
      },
      {
        "status": "affected",
        "version": "2.1.3"
      },
      {
        "status": "affected",
        "version": "2.2.0"
      },
      {
        "status": "affected",
        "version": "2.2.1"
      }
    ]
  }
]

References

search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2021-35530