PT-2021-5844 · Hitachi Energy · Hitachi Energy Xcm20+1

Published 2021-11-23 · Updated 2021-12-07 · CVE-2021-40333

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hitachi Energy FOX61x versions prior to R15A Hitachi Energy XCM20 versions prior to R15A

Description The issue is related to weak password requirements in the Data Communication Network (DCN) routing configuration, allowing an attacker to gain unauthorized access. This can be exploited by a remote attacker to access protected information.

Recommendations For Hitachi Energy FOX61x versions prior to R15A, update to version R15A or later to resolve the issue. For Hitachi Energy XCM20 versions prior to R15A, update to version R15A or later to resolve the issue. As a temporary workaround, consider strengthening password requirements for the Data Communication Network (DCN) routing configuration to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

BDU:2022-00359

CVE-2021-40333

Affected Products

Hitachi Energy Fox61X

Hitachi Energy Xcm20

References · 9

• https://bdu.fstec.ru/vul/2022-00359 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-40333 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000069&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40333 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000062&LanguageCode=en&DocumentPartId=&Action=Launch · Note
• https://t.me/cibsecurity/33283 · Telegram Post
• https://t.me/cvenotify/24130 · Telegram Post
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000069&LanguageCode=en&DocumentPartId=&Action=Launch · Note