CVE-2021-35531 - CVE House

Back to Database

Status published Medium CVE-2021-35531

Remote Code Execution in TXpert Hub CoreTec 4

6.7 CVSS

Vulnerability Description

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-35531

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua

More from Hitachi Energy

View All →

Use of default credentials vulnerability in Hitachi Energy SuprOS product

A vulnerability exists in the IEC 61850 in MicroSCADA X...

A vulnerability exists in the Web interface of the MicroSCADA...

A vulnerability exists in the IEC 61850 of the MicroSCADA...

A vulnerability exists in in the Monitor Pro interface of...

Affected Vendor

Hitachi Energy

View all reports →

Affected Software

TXpert Hub CoreTec 4 version

Vulnerable Versions:

2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.1

Timeline

Official Publish: June 7th, 2022

Last Modified: September 16th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation