CVE-2021-35534 Insufficient Security Control Vulnerability
Authenticated attackers can bypass security controls to modify data or firmware and permanently disable Hitachi Energy Relion devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-35534?
CVE-2021-35534 is a high-severity missing authorization vulnerability in Hitachi Energy GMS600, published on 18 Nov 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. Consequently, exploitation may lead to unauthorized modifications on data/firmware, and/or to permanently disabling the product. This issue affects: Hitachi Energy Relion 670 Series 2.0 all revisions; 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.5. Hitachi Energy Relion 670/650 Series 2.1 all revisions. 2.2.0 all revisions; 2.2.4 all revisions; Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions; 2.2.5 versions prior to 2.2.5.2. Hitachi Energy Relion 650 1.0 all revisions. 1.1 all revisions; 1.2 all revisions; 1.3 versions prior to 1.3.0.8; Hitachi Energy GMS600 1.3.0; 1.3.0.1; 1.2.0. Hitachi Energy PWC600 1.0.1 version 1.0.1.4 and prior versions; 1.1.0 version 1.1.0.1 and prior versions.
Which versions are affected by CVE-2021-35534?
It affects 5 products.
Products include Hitachienergy Gms600 Firmware, Hitachienergy Pwc600 Firmware, Hitachienergy Relion 650 Firmware, Hitachienergy Relion 670 Firmware, Hitachienergy Relion Sam600-Io Firmware.
How do I fix CVE-2021-35534?
No fix has been published for CVE-2021-35534 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-35534 being exploited?
There is no known exploitation of CVE-2021-35534 in the wild and no public exploit code.
Sources
Also known as GHSA-72pf-j5fj-gg32.