Main Vulnerability Database SB2022090711

SB2022090711 - Download of code without integrity check in Hitachi Energy TXpert Hub CoreTec 4

Published: September 7, 2022

Security Bulletin ID SB2022090711

Severity

Low

Patch available

Number of vulnerabilities 1

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Download of code without integrity check (CVE-ID: CVE-2021-35532)

The vulnerability allows a local user to compromise the affected system

The vulnerability exists due to software does not perform software integrity check when downloading updates within the file upload validation component. A local administrator can gain access to the system and obtain an account with sufficient privilege to then upload a malicious firmware to the product.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua