Vulnerabilities > Hitachienergy
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-07-25 | CVE-2021-40335 | Cross-Site Request Forgery (CSRF) vulnerability in Hitachienergy Modular Switchgear Monitoring Firmware 2.1.0/2.2.0 A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. | 8.8 |
| 2022-07-25 | CVE-2021-40336 | Injection vulnerability in Hitachienergy Modular Switchgear Monitoring Firmware 2.1.0/2.2.0 A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. | 8.8 |
| 2022-06-07 | CVE-2021-35530 | Unspecified vulnerability in Hitachienergy Txpert HUB Coretec 4 Firmware A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. | 6.7 |
| 2022-06-07 | CVE-2021-35531 | OS Command Injection vulnerability in Hitachienergy Txpert HUB Coretec 4 Firmware Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. | 6.7 |
| 2022-06-07 | CVE-2021-35532 | Unrestricted Upload of File with Dangerous Type vulnerability in Hitachienergy Txpert HUB Coretec 4 Firmware A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. | 6.7 |
| 2022-05-02 | CVE-2022-28613 | Improper Validation of Specified Quantity in Input vulnerability in multiple products A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. | 7.5 |
| 2022-03-11 | CVE-2021-27414 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Hitachienergy Ellipse Enterprise Asset Management 9.0.22 An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather authentication credentials. | 6.1 |
| 2022-03-11 | CVE-2021-27416 | Cross-site Scripting vulnerability in Hitachienergy Ellipse Enterprise Asset Management 9.0.22/9.0.23/9.0.25 An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. | 5.4 |
| 2021-12-02 | CVE-2021-40333 | Weak Password Requirements vulnerability in Hitachienergy Fox615 Firmware and Xcm20 Firmware Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. | 7.1 |
| 2021-12-02 | CVE-2021-40334 | Unspecified vulnerability in Hitachienergy Fox615 Firmware and Xcm20 Firmware Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that exploits the vulnerability by activating SSH on port TCP 5558 to cause disruption to the NMS and NE communication. | 7.5 |