CVE-2021-35531 Remote Code Execution in TXpert Hub CoreTec 4

2022-06-0720:07:37

CWE-20

Hitachi Energy

www.cve.org

improper input validation

hitachi energy txpert hub coretec

os command injection

version 2.0.0

version 2.0.1

version 2.1.0

version 2.1.1

version 2.1.2

version 2.1.3

version 2.2.0

version 2.2.1

EPSS

Percentile

13.1%

JSON

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

CNA Affected

[
  {
    "product": "TXpert Hub CoreTec 4 version",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.0"
      },
      {
        "status": "affected",
        "version": "2.0.1"
      },
      {
        "status": "affected",
        "version": "2.1.0"
      },
      {
        "status": "affected",
        "version": "2.1.1"
      },
      {
        "status": "affected",
        "version": "2.1.2"
      },
      {
        "status": "affected",
        "version": "2.1.3"
      },
      {
        "status": "affected",
        "version": "2.2.0"
      },
      {
        "status": "affected",
        "version": "2.2.1"
      }
    ]
  }
]

References

search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua

EPSS

Percentile

13.1%

JSON

Related for CVELIST:CVE-2021-35531