Vulnerabilites related to Hitachi Energy - TXpert Hub CoreTec 4 version
CVE-2021-35531 (GCVE-0-2021-35531)
Vulnerability from cvelistv5
Published
2022-06-07 20:07
Modified
2024-09-16 16:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
Summary
Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Hitachi Energy | TXpert Hub CoreTec 4 version |
Version: 2.0.0 Version: 2.0.1 Version: 2.1.0 Version: 2.1.1 Version: 2.1.2 Version: 2.1.3 Version: 2.2.0 Version: 2.2.1 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T00:40:46.422Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "TXpert Hub CoreTec 4 version", "vendor": "Hitachi Energy", "versions": [ { "status": "affected", "version": "2.0.0" }, { "status": "affected", "version": "2.0.1" }, { "status": "affected", "version": "2.1.0" }, { "status": "affected", "version": "2.1.1" }, { "status": "affected", "version": "2.1.2" }, { "status": "affected", "version": "2.1.3" }, { "status": "affected", "version": "2.2.0" }, { "status": "affected", "version": "2.2.1" } ] } ], "datePublic": "2022-05-10T00:00:00", "descriptions": [ { "lang": "en", "value": "Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-06-07T20:07:37", "orgId": "e383dce4-0c27-4495-91c4-0db157728d17", "shortName": "Hitachi Energy" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ], "solutions": [ { "lang": "en", "value": "Update the system to TXpert Hub CoreTec 4 version 2.3.0 that fixes the issues." } ], "source": { "discovery": "UNKNOWN" }, "title": "Remote Code Execution in TXpert Hub CoreTec 4", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cybersecurity@hitachienergy.com", "DATE_PUBLIC": "2022-05-10T10:00:00.000Z", "ID": "CVE-2021-35531", "STATE": "PUBLIC", "TITLE": "Remote Code Execution in TXpert Hub CoreTec 4" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "TXpert Hub CoreTec 4 version", "version": { "version_data": [ { "version_affected": "=", "version_name": "2.0.0", "version_value": "2.0.0" }, { "version_affected": "=", "version_name": "2.0.1", "version_value": "2.0.1" }, { "version_affected": "=", "version_name": "2.1.0", "version_value": "2.1.0" }, { "version_affected": "=", "version_name": "2.1.1", "version_value": "2.1.1" }, { "version_affected": "=", "version_name": "2.1.2", "version_value": "2.1.2" }, { "version_affected": "=", "version_name": "2.1.3", "version_value": "2.1.3" }, { "version_affected": "=", "version_name": "2.2.0", "version_value": "2.2.0" }, { "version_affected": "=", "version_name": "2.2.1", "version_value": "2.2.1" } ] } } ] }, "vendor_name": "Hitachi Energy" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-20 Improper Input Validation" } ] } ] }, "references": { "reference_data": [ { "name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua", "refsource": "CONFIRM", "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ] }, "solution": [ { "lang": "en", "value": "Update the system to TXpert Hub CoreTec 4 version 2.3.0 that fixes the issues." } ], "source": { "discovery": "UNKNOWN" } } } }, "cveMetadata": { "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17", "assignerShortName": "Hitachi Energy", "cveId": "CVE-2021-35531", "datePublished": "2022-06-07T20:07:37.055446Z", "dateReserved": "2021-06-28T00:00:00", "dateUpdated": "2024-09-16T16:12:33.151Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2021-35530 (GCVE-0-2021-35530)
Vulnerability from cvelistv5
Published
2022-06-07 20:17
Modified
2024-09-16 23:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Summary
A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Hitachi Energy | TXpert Hub CoreTec 4 version |
Version: 2.0.0 Version: 2.0.1 Version: 2.1.0 Version: 2.1.1 Version: 2.1.2 Version: 2.1.3 Version: 2.2.0 Version: 2.2.1 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T00:40:46.698Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "TXpert Hub CoreTec 4 version", "vendor": "Hitachi Energy", "versions": [ { "status": "affected", "version": "2.0.0" }, { "status": "affected", "version": "2.0.1" }, { "status": "affected", "version": "2.1.0" }, { "status": "affected", "version": "2.1.1" }, { "status": "affected", "version": "2.1.2" }, { "status": "affected", "version": "2.1.3" }, { "status": "affected", "version": "2.2.0" }, { "status": "affected", "version": "2.2.1" } ] } ], "datePublic": "2022-05-10T00:00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability in the application authentication and authorization mechanism in Hitachi Energy\u0027s TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-06-07T20:17:07", "orgId": "e383dce4-0c27-4495-91c4-0db157728d17", "shortName": "Hitachi Energy" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ], "solutions": [ { "lang": "en", "value": "Update the system to TXpert Hub CoreTec 4 version 2.3.0 that fixes the issues." } ], "source": { "discovery": "INTERNAL" }, "title": "User authentication bypass in TXpert Hub CoreTec 4", "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cybersecurity@hitachienergy.com", "DATE_PUBLIC": "2022-05-10T10:00:00.000Z", "ID": "CVE-2021-35530", "STATE": "PUBLIC", "TITLE": "User authentication bypass in TXpert Hub CoreTec 4" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "TXpert Hub CoreTec 4 version", "version": { "version_data": [ { "version_affected": "=", "version_name": "2.0.0", "version_value": "2.0.0" }, { "version_affected": "=", "version_name": "2.0.1", "version_value": "2.0.1" }, { "version_affected": "=", "version_name": "2.1.0", "version_value": "2.1.0" }, { "version_affected": "=", "version_name": "2.1.1", "version_value": "2.1.1" }, { "version_affected": "=", "version_name": "2.1.2", "version_value": "2.1.2" }, { "version_affected": "=", "version_name": "2.1.3", "version_value": "2.1.3" }, { "version_affected": "=", "version_name": "2.2.0", "version_value": "2.2.0" }, { "version_affected": "=", "version_name": "2.2.1", "version_value": "2.2.1" } ] } } ] }, "vendor_name": "Hitachi Energy" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability in the application authentication and authorization mechanism in Hitachi Energy\u0027s TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": { "cvss": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L", "version": "3.1" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-288 Authentication Bypass Using an Alternate Path or Channel" } ] } ] }, "references": { "reference_data": [ { "name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua", "refsource": "CONFIRM", "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ] }, "solution": [ { "lang": "en", "value": "Update the system to TXpert Hub CoreTec 4 version 2.3.0 that fixes the issues." } ], "source": { "discovery": "INTERNAL" } } } }, "cveMetadata": { "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17", "assignerShortName": "Hitachi Energy", "cveId": "CVE-2021-35530", "datePublished": "2022-06-07T20:17:07.848239Z", "dateReserved": "2021-06-28T00:00:00", "dateUpdated": "2024-09-16T23:26:19.387Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2021-35532 (GCVE-0-2021-35532)
Vulnerability from cvelistv5
Published
2022-06-07 20:04
Modified
2024-09-16 22:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-494 - Download of Code Without Integrity Check
Summary
A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Hitachi Energy | TXpert Hub CoreTec 4 version |
Version: 2.0.0 Version: 2.0.1 Version: 2.1.0 Version: 2.1.1 Version: 2.1.2 Version: 2.1.3 Version: 2.2.0 Version: 2.2.1 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T00:40:46.763Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "TXpert Hub CoreTec 4 version", "vendor": "Hitachi Energy", "versions": [ { "status": "affected", "version": "2.0.0" }, { "status": "affected", "version": "2.0.1" }, { "status": "affected", "version": "2.1.0" }, { "status": "affected", "version": "2.1.1" }, { "status": "affected", "version": "2.1.2" }, { "status": "affected", "version": "2.1.3" }, { "status": "affected", "version": "2.2.0" }, { "status": "affected", "version": "2.2.1" } ] } ], "datePublic": "2022-05-10T00:00:00", "descriptions": [ { "lang": "en", "value": "A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-494", "description": "CWE-494 Download of Code Without Integrity Check", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-06-07T20:04:14", "orgId": "e383dce4-0c27-4495-91c4-0db157728d17", "shortName": "Hitachi Energy" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ], "source": { "discovery": "UNKNOWN" }, "title": "Firmware upload verification bypass in TXpert Hub CoreTec 4", "workarounds": [ { "lang": "en", "value": "To reduce risk of exploitation, please apply the recommended mitigation as described in the advisory Section Mitigation Factors/Workarounds." } ], "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cybersecurity@hitachienergy.com", "DATE_PUBLIC": "2022-05-10T10:00:00.000Z", "ID": "CVE-2021-35532", "STATE": "PUBLIC", "TITLE": "Firmware upload verification bypass in TXpert Hub CoreTec 4" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "TXpert Hub CoreTec 4 version", "version": { "version_data": [ { "version_affected": "=", "version_name": "2.0.0", "version_value": "2.0.0" }, { "version_affected": "=", "version_name": "2.0.1", "version_value": "2.0.1" }, { "version_affected": "=", "version_name": "2.1.0", "version_value": "2.1.0" }, { "version_affected": "=", "version_name": "2.1.1", "version_value": "2.1.1" }, { "version_affected": "=", "version_name": "2.1.2", "version_value": "2.1.2" }, { "version_affected": "=", "version_name": "2.1.3", "version_value": "2.1.3" }, { "version_affected": "=", "version_name": "2.2.0", "version_value": "2.2.0" }, { "version_affected": "=", "version_name": "2.2.1", "version_value": "2.2.1" } ] } } ] }, "vendor_name": "Hitachi Energy" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-494 Download of Code Without Integrity Check" } ] } ] }, "references": { "reference_data": [ { "name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua", "refsource": "CONFIRM", "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch\u0026utm_campaign=\u0026utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03\u0026utm_medium=email\u0026utm_source=Eloqua" } ] }, "source": { "discovery": "UNKNOWN" }, "work_around": [ { "lang": "en", "value": "To reduce risk of exploitation, please apply the recommended mitigation as described in the advisory Section Mitigation Factors/Workarounds." } ] } } }, "cveMetadata": { "assignerOrgId": "e383dce4-0c27-4495-91c4-0db157728d17", "assignerShortName": "Hitachi Energy", "cveId": "CVE-2021-35532", "datePublished": "2022-06-07T20:04:14.525785Z", "dateReserved": "2021-06-28T00:00:00", "dateUpdated": "2024-09-16T22:30:08.831Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }