CVE-2021-35532: hitachi energy txpert hub coretec 4 version Download of Code Without Integrity Check
Vulnerability summary
CVE-2021-35532 is a high (CVSS 7.2) Download of Code Without Integrity Check vulnerability in hitachi energy txpert hub coretec 4 version. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities.
Timeline
- 07-06-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A vulnerability exists in the file upload validation part of Hitachi Energy TXpert Hub CoreTec 4 product. The vulnerability allows an attacker or malicious agent who manages to gain access to the system and obtain an account with sufficient privilege to upload a malicious firmware to the product. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
0.00 pp
From 0.16% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Hitachi energy1 product
- txpert hub coretec 4 version2.0.0 | 2.0.1 | 2.1.0 | 2.1.1 | 2.1.2 | 2.1.3 | 2.2.0 | 2.2.1
Hitachienergy1 product
- txpert_hub_coretec_4_firmware2.0.0 | 2.0.1 | 2.1.0 | 2.1.1 | 2.1.2 | 2.1.3 | 2.2.0 | 2.2.1
2 vendors · 2 products