SB2022090711 - Download of code without integrity check in Hitachi Energy TXpert Hub CoreTec 4

Security Bulletin ID SB2022090711

CSH Severity

Low

Patch available

NO

Number of vulnerabilities 1

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Download of code without integrity check (CVE-ID: CVE-2021-35532)

CWE-ID: CWE-494 - Download of Code Without Integrity Check

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to compromise the affected system

The vulnerability exists due to software does not perform software integrity check when downloading updates within the file upload validation component. A local administrator can gain access to the system and obtain an account with sufficient privilege to then upload a malicious firmware to the product.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua