How severe is CVE-2021-35530?

CVE-2021-35530 has a CVSS 3.x base score of 6.0, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.

Is CVE-2021-35530 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-35530?

CVE-2021-35530 primarily affects Hitachienergy Txpert Hub Coretec 4 Firmware. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-35530?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-35530 published?

CVE-2021-35530 was published on 2022-06-07 and last updated on 2026-06-17.

CVE-2021-35530

CVE-2021-35530 is a medium-severity vulnerability in Hitachienergy Txpert Hub Coretec 4 Firmware with a CVSS 3.x base score of 6.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-288.

Key facts

Severity: Medium (CVSS 3.x base score 6.0)
CVSS v2: 7.2
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-288
Affected product: Hitachienergy Txpert Hub Coretec 4 Firmware
Published: 2022-06-07
Last modified: 2026-06-17

Description

A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

Frequently asked questions

What is CVE-2021-35530?: A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
How severe is CVE-2021-35530?: CVE-2021-35530 has a CVSS 3.x base score of 6.0, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
Is CVE-2021-35530 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-35530?: CVE-2021-35530 primarily affects Hitachienergy Txpert Hub Coretec 4 Firmware. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-35530?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-35530 published?: CVE-2021-35530 was published on 2022-06-07 and last updated on 2026-06-17.

References

https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua

Affected products (8)

cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.0:*:*:*:*:*:*:*
cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.1:*:*:*:*:*:*:*
cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.0:*:*:*:*:*:*:*
cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.1:*:*:*:*:*:*:*
cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.2:*:*:*:*:*:*:*
cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.3:*:*:*:*:*:*:*
cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.1:*:*:*:*:*:*:*

More vulnerabilities in Hitachienergy Txpert Hub Coretec 4 Firmware

CVE-2021-35532 — Medium (CVSS 6.7): A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The…
CVE-2021-35531 — Medium (CVSS 6.7): Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub…
CVE-2022-3353 — Medium (CVSS 5.9): A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An…

All CVEs affecting Hitachienergy Txpert Hub Coretec 4 Firmware →

Other CWE-288 vulnerabilities

CVE-2026-53622 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's…
CVE-2026-48491 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in…
CVE-2026-48020 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity…
CVE-2026-20079 — Critical (CVSS 10.0): A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an…
CVE-2024-10081 — Critical (CVSS 10.0): CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.…
CVE-2024-2973 — Critical (CVSS 10.0): An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or…

Browse all CWE-288 vulnerabilities →