CVE-2021-35531 Remote Code Execution in TXpert Hub CoreTec 4

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects:...

CVE-2021-35531

CVE-2021-35531 applies to Hitachi Energy TXpert Hub CoreTec 4. Affected versions: 2.0.0–2.2.1. Root cause: Improper Input Validation in a particular configuration setting field. Attack scenario: an attacker with access to an authorized user with ADMIN or ENGINEER rights can inject an OS command t...

CVE-2021-35532

CVE-2021-35532 is a vulnerability in the file upload validation component of Hitachi Energy TXpert Hub CoreTec 4. Affected versions are 2.0.0, 2.0.1, 2.1.0–2.2.1. The issue allows an attacker who has system access and a privileged account to upload a malicious firmware image, potentially compromi...

CVE-2021-35532 Firmware upload verification bypass in TXpert Hub CoreTec 4

A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product...

Hitachi Energy TXpert Hub CoreTec 4 代码问题漏洞

Hitachi Energy TXpert Hub CoreTec 4 is a digital transformer monitoring and diagnostic device from Hitachi, Japan. A security vulnerability exists in the Hitachi Energy TXpert Hub CoreTec 4 that stems from a problem in the file upload validation section. An attacker could use this vulnerability t...

Hitachi Energy TXpert Hub CoreTec 4 操作系统命令注入漏洞

The Hitachi Energy TXpert Hub CoreTec 4 is a digital transformer monitoring and diagnostic device from Hitachi, Ltd Hitachi, Japan. The Hitachi Energy TXpert Hub CoreTec 4 suffers from an operating system command injection vulnerability that originates from incorrect input validation in a...

PT-2022-10467 · Hitachi Energy · Hitachi Energy Txpert Hub Coretec 4

Name of the Vulnerable Software and Affected Versions: Hitachi Energy TXpert Hub CoreTec 4 versions 2.0.0 through 2.2.1 Description: The issue is related to an Improper Input Validation vulnerability in a particular configuration setting field of the Hitachi Energy TXpert Hub CoreTec 4 product...

Weak Password Vulnerability in Siemens Smart Energy Management Platform

Siemens is a technology-focused company that provides solutions for customers in the areas of power generation and transmission and distribution, infrastructure, industrial automation, drives and software through innovations in electrification, automation and digitalization. A weak password...

vermilionenergy.fr Cross Site Scripting vulnerability OBB-2627825

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cybercrime Getting More Sophisticated: How to Protect Your Business?

Can it happen to us? Are we ready to combat a cyberattack? All over the world, security officers have been fielding these questions from CEOs and the Board of Directors in the wake of large, high-profile cyberattacks. Yes, is the honest answer when attackers have continuously expanded their...

Bluetooth Flaw Allows Remote Unlocking of Digital Locks

Locks that use Bluetooth Low Energy to authenticate keys are vulnerable to remote unlocking. The research focused on Teslas, but the exploit is generalizable. In a video shared with Reuters, NCC Group researcher Sultan Qasim Khan was able to open and then drive a Tesla using a small relay device...

OilRig is back with another Phishing Email attack, delivering the Saitama Backdoor

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here An Iranian cyber espionage gang known as OilRig has began delivering malicious email to a Jordanian government employee at the foreign ministry. The email includes a malicious Excel sheet that installs the Saitama backdoor...

PT-2022-5038 · Hitachi Energy · Microscada X Sys600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MicroSCADA X SYS600 versions 10 through 10.3.1 Description: The issue is caused by improper input validation in a specific configuration file, leading to a buffer-overflow. This can cause the SYS600 to fail to start. The...

PT-2022-7195 · Ultraloq · Ultraloq Ul3 2Nd Gen Smart Lock

Name of the Vulnerable Software and Affected Versions: Ultraloq UL3 2nd Gen Smart Lock Firmware version 02.27.0012 Description: The issue is related to incorrect session management and credential re-use in the Bluetooth LE stack, allowing an attacker to sniff the unlock code and unlock the device...

The vulnerability of the HCI component, which operates on the Modbus TCP protocol, and is found in Hitachi Energy RTU500 CMU series programmable logic controllers, allows a attacker to trigger a system reboot.

The vulnerability of the HCI component, which operates on the Modbus TCP protocol and is part of the Hitachi Energy RTU500 CMU series programmable logic controllers, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to trigger a device reboot...

CVE-2021-35532

A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product...

CVE-2021-35531

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects:...

vermilionenergy.fr Cross Site Scripting vulnerability OBB-2613528

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-36029)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...

Delta Electronics DIAEnergie SQL Injection Vulnerability (CNVD-2022-36027)

Delta Electronics DIAEnergie is an industrial energy management system for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and maximizing energy efficiency. Delta...