CVE-2021-35535
mediumPriorität · verfolgen · 32OT-Risiko · erhöhtEPSS 0.007 · 52. PerzentilEUUSEPSS · bewertet 2026-10-27
Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process where an older version of VxWorks is loaded prior to application firmware booting, could exploit the vulnerability in the older version of VxWorks and cause a denial-of-service on the product. This issue affects: Hitachi Energy Relion 670 Series 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.3. Hitachi Energy Relion 670/650 Series 2.2.0 all revisions; 2.2.4 all revisions. Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenRelion 650cisa_csaf_ot
Update to 2.2.1.7 version or latest
- BehobenRelion 670cisa_csaf_ot
Update to 2.2.1.7 version or latest
- BehobenSAM-IOcisa_csaf_ot
Update to 2.2.1.7 version or latest
- MitigationRelion 650cisa_csaf_ot
Apply General Mitigation Factors
- MitigationRelion 670cisa_csaf_ot
Apply General Mitigation Factors
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–8.1
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (32)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-21-336-05Hitachi Energy Relion 670/650/SAM600-IO2021-11-04icsa · cisa_csaf_otUS
Hitachi Energy is aware of a report from U.S. Department of Energy CyTRICS researcher of a vulnerability in the Relion 670/650/SAM600-IO series versions listed below. Recommended action for each affected version is listed in the Recommended Immediate Actions Section. An attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process where an older version of VxWorks is loaded prior to application firmware booting, could exploit the vulnerability in the older version of VxWorks and cause a denial-of-service on the product.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2021-35535cnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000061&LanguageCode=en&DocumentPartId=&Action=Launchcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-336-05cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4102cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021120321cnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000061&LanguageCode=en&DocumentPartId=&Action=Launchenisa_euvd
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000061&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan