PT-2022-10467 · Hitachi Energy · Hitachi Energy Txpert Hub Coretec 4

Published 2022-06-07 · Updated 2023-06-26 · CVE-2021-35531

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hitachi Energy TXpert Hub CoreTec 4 versions 2.0.0 through 2.2.1

Description The issue is related to an Improper Input Validation vulnerability in a particular configuration setting field of the Hitachi Energy TXpert Hub CoreTec 4 product. This vulnerability allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system.

Recommendations For versions 2.0.0 through 2.2.1, consider restricting access to the configuration setting field to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of users with ADMIN or ENGINEER role rights to reduce the potential impact of an attack.

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2021-35531

Affected Products

Hitachi Energy Txpert Hub Coretec 4

References · 6

• https://osv.dev/vulnerability/CVE-2021-35531 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35531 · Security Note
• https://t.me/cvenotify/31715 · Telegram Post
• https://t.me/cvenotify/48610 · Telegram Post
• https://t.me/cibsecurity/43980 · Telegram Post