Lucene search

K
cve[email protected]CVE-2021-35530
HistoryJun 07, 2022 - 9:15 p.m.

CVE-2021-35530

2022-06-0721:15:14
CWE-288
web.nvd.nist.gov
46
6
vulnerability
hitachi energy
txpert hub coretec 4
unauthorized access
password change
nvd
cve-2021-35530

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

A vulnerability in the application authentication and authorization mechanism in Hitachi Energy’s TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

Affected configurations

NVD
Node
hitachienergytxpert_hub_coretec_4_firmwareMatch2.0.0
OR
hitachienergytxpert_hub_coretec_4_firmwareMatch2.0.1
OR
hitachienergytxpert_hub_coretec_4_firmwareMatch2.1.0
OR
hitachienergytxpert_hub_coretec_4_firmwareMatch2.1.1
OR
hitachienergytxpert_hub_coretec_4_firmwareMatch2.1.2
OR
hitachienergytxpert_hub_coretec_4_firmwareMatch2.1.3
OR
hitachienergytxpert_hub_coretec_4_firmwareMatch2.2.0
OR
hitachienergytxpert_hub_coretec_4_firmwareMatch2.2.1
AND
hitachienergytxpert_hub_coretec_4Match-

CNA Affected

[
  {
    "product": "TXpert Hub CoreTec 4 version",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.0"
      },
      {
        "status": "affected",
        "version": "2.0.1"
      },
      {
        "status": "affected",
        "version": "2.1.0"
      },
      {
        "status": "affected",
        "version": "2.1.1"
      },
      {
        "status": "affected",
        "version": "2.1.2"
      },
      {
        "status": "affected",
        "version": "2.1.3"
      },
      {
        "status": "affected",
        "version": "2.2.0"
      },
      {
        "status": "affected",
        "version": "2.2.1"
      }
    ]
  }
]

Social References

More

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

Related for CVE-2021-35530