PT-2022-10468 · Hitachi Energy · Hitachi Energy Txpert Hub Coretec 4

Published 2022-06-07 · Updated 2023-04-19 · CVE-2021-35532

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hitachi Energy TXpert Hub CoreTec 4 versions 2.0.0 through 2.2.1

Description A vulnerability exists in the file upload validation part of the Hitachi Energy TXpert Hub CoreTec 4 product. This issue allows an attacker or malicious agent who gains access to the system and obtains an account with sufficient privilege to upload malicious firmware to the product.

Recommendations For versions 2.0.0 through 2.2.1, consider disabling the file upload feature until a patch is available to prevent malicious firmware uploads. Restrict access to the system and limit account privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-494

Related Identifiers

CVE-2021-35532

Affected Products

Hitachi Energy Txpert Hub Coretec 4

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-35532 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35532 · Vendor Advisory
• https://t.me/cibsecurity/43982 · Telegram Post
• https://t.me/cvenotify/48609 · Telegram Post
• https://t.me/cvenotify/31716 · Telegram Post