PT-2021-20958 · Hitachi Energy · Relion 670/650 Series+2

Published 2021-11-18 · Updated 2023-04-19 · CVE-2021-35535

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Hitachi Energy Relion 670 Series versions 2.2.2 through 2.2.3.2 Hitachi Energy Relion 670/650 Series versions 2.2.0 through 2.2.4 Hitachi Energy Relion 670/650/SAM600-IO version 2.2.1

Description: The issue is related to an Insecure Boot Image vulnerability in the Hitachi Energy Relion 670/650/SAM600-IO series. An attacker with access to the front network port may cause a reboot sequence, exploiting a tiny time gap during the booting process where an older version of VxWorks is loaded. This could lead to a denial-of-service on the product.

Recommendations: For Hitachi Energy Relion 670 Series version 2.2.2, update to version 2.2.3.3 or later. For Hitachi Energy Relion 670 Series versions prior to 2.2.3.3, update to version 2.2.3.3 or later. For Hitachi Energy Relion 670/650 Series versions 2.2.0 and 2.2.4, consider disabling the vulnerable boot process until a patch is available. For Hitachi Energy Relion 670/650/SAM600-IO version 2.2.1, restrict access to the front network port to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability for some versions, so consider the above recommendations as temporary workarounds.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2021-35535

Affected Products

Relion 670 Series

Relion 670/650 Series

Relion 670/650/Sam600-Io

References · 5

• https://osv.dev/vulnerability/CVE-2021-35535 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35535 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000061&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://t.me/cvenotify/48605 · Telegram Post
• https://t.me/cibsecurity/32611 · Telegram Post