CVE-2021-27416 - CVE House
Back to Database
Status published Medium CVE-2021-27416

Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM

Vulnerability Description

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of confidential information, or even the takeover of the user’s session.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-27416

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Hitachi ABB Power Grids reported these vulnerabilities to CISA.

References

More from Hitachi ABB Power Grids

View All →
CVE-2021-35529
Password in Memory Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB)
High 7.7
CVE-2021-35527
Password Autocomplete Vulnerability in Hitachi ABB Power Grids eSOMS Application
High 7.5
CVE-2021-35526
Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product
Medium 6.3
CVE-2021-27414
User interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAM
Medium 5.5

Affected Vendor

Hitachi ABB Power Grids

View all reports →

Affected Software

Ellipse Enterprise Asset Management (EAM)
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 11th, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact