CVE-2021-35534
highpriority · track · 30EPSS 0.018 · 78 %ileDEEUUSEPSS · scored 2026-10-27
Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. Consequently, exploitation may lead to unauthorized modifications on data/firmware, and/or to permanently disabling the product. This issue affects: Hitachi Energy Relion 670 Series 2.0 all revisions; 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.5. Hitachi Energy Relion 670/650 Series 2.1 all revisions. 2.2.0 all revisions; 2.2.4 all revisions; Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions; 2.2.5 versions prior to 2.2.5.2. Hitachi Energy Relion 650 1.0 all revisions. 1.1 all revisions; 1.2 all revisions; 1.3 versions prior to 1.3.0.8; Hitachi Energy GMS600 1.3.0; 1.3.0.1; 1.2.0. Hitachi Energy PWC600 1.0.1 version 1.0.1.4 and prior versions; 1.1.0 version 1.1.0.1 and prior versions.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedGMS600cisa_csaf_ot
Relion 650 series Version 1.2: Update to Version 1.3
- FixedPWC600cisa_csaf_ot
Relion 650 series Version 1.2: Update to Version 1.3
- FixedRelion 650 seriescisa_csaf_ot
Relion 650 series Version 1.2: Update to Version 1.3
- FixedRelion 670 Seriescisa_csaf_ot
Relion 650 series Version 1.2: Update to Version 1.3
- FixedRelion 670/650 Seriescisa_csaf_ot
Relion 650 series Version 1.2: Update to Version 1.3
- FixedRelion 670/650/SAM600-IO Seriescisa_csaf_ot
Relion 650 series Version 1.2: Update to Version 1.3
- FixedHitachi Energy Relion 650 series version 1.3.0.8cisa_csaf_ot
Update to Relion 650 series version 1.3.0.8
- FixedHitachi Energy Relion 650 series version 2.1.0 revisions up to 2.1.0.4cisa_csaf_ot
Update to Relion 670/650 series version 2.1.0.5
- FixedHitachi Energy Relion 650 series version 2.2.1 revisions up to 2.2.1.7cisa_csaf_ot
Update to Relion 670/650/SAM600-IO series version 2.2.1.8
- FixedHitachi Energy Relion 650 series version 2.2.4 revisions up to 2.2.4.2cisa_csaf_ot
Update to Relion 670/650 series version 2.2.4.3
- FixedHitachi Energy Relion 670 series version 2.0.0 revisions up to 2.0.0.13cisa_csaf_ot
Update to Relion 670/650 series version 2.0.0.14
- FixedHitachi Energy Relion 670 series version 2.1.0 revisions up to 2.1.0.4cisa_csaf_ot
Update to Relion 670/650 series version 2.1.0.5
- FixedHitachi Energy Relion 670 series version 2.2.1 revisions up to 2.2.1.7cisa_csaf_ot
Update to Relion 670/650/SAM600-IO series version 2.2.1.8
- FixedHitachi Energy Relion 670 series version 2.2.2 revisions up to 2.2.2.4cisa_csaf_ot
Update to Relion 670 series version 2.2.2.5
- FixedHitachi Energy Relion 670 series version 2.2.3 revisions up to 2.2.3.4cisa_csaf_ot
Update to Relion 670 series version 2.2.3.5
- FixedHitachi Energy Relion 670 series version 2.2.4 revisions up to 2.2.4.2cisa_csaf_ot
Update to Relion 670/650 series version 2.2.4.3
- FixedHitachi Energy Relion 670 series version 2.2.5 up to revision 2.2.5.1cisa_csaf_ot
Update to Relion 670/650/SAM600-IO series version 2.2.5.2
- FixedHitachi Energy Relion SAM600-IO series version 2.2.1 revisions up to 2.2.1.7cisa_csaf_ot
Update to Relion 670/650/SAM600-IO series version 2.2.1.8
- FixedHitachi Energy Relion SAM600-IO series version 2.2.5 up to revision 2.2.5.1cisa_csaf_ot
Update to Relion 670/650/SAM600-IO series version 2.2.5.2
- MitigationGMS600cisa_csaf_ot
Do not directly connect to the Internet.
- MitigationPWC600cisa_csaf_ot
Do not directly connect to the Internet.
- MitigationRelion 650 seriescisa_csaf_ot
Do not directly connect to the Internet.
- MitigationRelion 670 Seriescisa_csaf_ot
Do not directly connect to the Internet.
- MitigationRelion 670/650 Seriescisa_csaf_ot
Do not directly connect to the Internet.
- MitigationRelion 670/650/SAM600-IO Seriescisa_csaf_ot
Do not directly connect to the Internet.
- MitigationHitachi Energy Relion 650 series version 1.0.0 all revisionscisa_csaf_ot
Refer to the General Mitigation Factors/Workaround Section for the current mitigation strategy.
- MitigationHitachi Energy Relion 650 series version 1.1.0 all revisionscisa_csaf_ot
Refer to the General Mitigation Factors/Workaround Section for the current mitigation strategy.
- MitigationHitachi Energy Relion 650 series version 1.2.0 all revisionscisa_csaf_ot
Refer to the Mitigation Factors/Workaround Section for the current mitigation strategy or upgrade to Relion 650 series version 1.3.
- MitigationHitachi Energy Relion 670 series version 2.2.0 all revisionscisa_csaf_ot
Refer to the General Mitigation Factors/Workaround Section for the current mitigation strategy.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–9
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (88)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0436Hitachi Energy Relion: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2021-12-09csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Hitachi Energy Relion ausnutzen, um seine Privilegien zu erhöhen.
- ICSA-21-343-01Hitachi Energy GMS600, PWC600, and Relion2021-12-09icsa · cisa_csaf_otUS
This updated advisory is a follow-up to the original advisory titled ICSA-21-343-01 Hitachi Energy GMS600, PWC600, and Relion that was published December 9, 2021, on the ICS webpage at cisa.gov/ics.
- ICSA-25-065-02Hitachi Energy Relion 670/650/SAM600-IO2021-11-04icsa · cisa_csaf_otUS
Hitachi Energy is aware of a vulnerability report from U.S. Department of Energy CyTRICS researcher of a vulnerability in the Relion® 670/650/SAM600-IO series versions listed below. Remediation is available for some versions. Recommended actions for each affected version are listed in the Recommended Immediate Actions Section. An attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. Consequently, exploitation may lead to unauthorized modifications on data/firmware, and/or to permanently disabling the product.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2021-35534cnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000058&LanguageCode=en&DocumentPartId=&Action=Launchcnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000059&LanguageCode=en&DocumentPartId=&Action=Launchcnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000060&LanguageCode=en&DocumentPartId=&Action=Launchcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-343-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4180cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021121004cnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000058&LanguageCode=en&DocumentPartId=&Action=Launchenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan