Skip to content
OpenAdvisories
Medium ICSA-22-249-04 3 CVEs

Hitachi Energy TXpert Hub CoreTec 4

Published Sep 6, 2022 · Updated Sep 6, 2022

Vendor: Hitachi Energy Product: TXpert Hub CoreTec 4

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the product, modify configuration, obtain sensitive information from the device, and load malicious firmware.

Vulnerabilities 3

  • Medium 6.0
    CVE-2021-35530

    User authentication bypass in TXpert Hub CoreTec 4

    A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling…

    Hitachi Energy TXpert Hub CoreTec 4 version ICS / OT
  • Unscored —
    CVE-2021-35531

    Remote Code Execution in TXpert Hub CoreTec 4

    Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is execute…

    Hitachi Energy TXpert Hub CoreTec 4 version ICS / OT
  • Unscored —
    CVE-2021-35532

    Firmware upload verification bypass in TXpert Hub CoreTec 4

    A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to uploa…

    Hitachi Energy TXpert Hub CoreTec 4 version ICS / OT

Revision history

  1. #1

    Publication Date

References