CVE-2021-35526: Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product
Vulnerability summary
CVE-2021-35526 is a high (CVSS 7.8) vulnerability in hitachi abb power grids system data manager – sdm600. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.1% of scored vulnerabilities.
Timeline
- 08-09-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior to FP2 HF6 (Build Nr. 1.2.14002.257).
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA6.3MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.13% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Hitachi abb power grids1 product
- system data manager – sdm600≥ 1.2, < FP2 HF6
Hitachiabb-powergrids1 product
- sdm600_firmware≥ 1.2, < 1.2.14002.257
2 vendors · 2 products
References
2 links- us-cert.cisa.gov/ics/advisories/icsa-21-250-02X Refsource CONFIRMThird Party AdvisoryUS Government Resource