Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM

published 2022-03-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-14170

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of confidential information, or even the takeover of the user’s session.

Patch / fix

fixed in 1

hitachienergy ellipse_enterprise_asset_management 9.0.26

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-061-01 updated 2021-03-02 cvss 5.5

Hitachi ABB Power Grids Ellipse EAM

Hitachi Energy Ellipse EAM <= 9.0.25
affected: vendor fix, mitigation “Hitachi ABB Power Grids published cybersecurity advisory PGVU-PGGA-Ellipse-202027 to give users more information about this issue.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-16)

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM)

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

search.abb.com /library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch
vendor-advisory
cisa.gov /uscert/ics/advisories/icsa-21-061-01
third-party-advisory, us-government-resource

Sources

CVE List CVE-2021-27416
NVD CVE-2021-27416

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary