Skip to content
Fencer Vulns
high 7.2

CVE-2021-35534 json

Insufficient Security Control Vulnerability

published 2021-11-18 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-22170

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. Consequently, exploitation may lead to unauthorized modifications on data/firmware, and/or to permanently disabling the product. This issue affects: Hitachi Energy Relion 670 Series 2.0 all revisions; 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.5. Hitachi Energy Relion 670/650 Series 2.1 all revisions. 2.2.0 all revisions; 2.2.4 all revisions; Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions; 2.2.5 versions prior to 2.2.5.2. Hitachi Energy Relion 650 1.0 all revisions. 1.1 all revisions; 1.2 all revisions; 1.3 versions prior to 1.3.0.8; Hitachi Energy GMS600 1.3.0; 1.3.0.1; 1.2.0. Hitachi Energy PWC600 1.0.1 version 1.0.1.4 and prior versions; 1.1.0 version 1.1.0.1 and prior versions.

Patch / fix

  • Hitachi Energy Relion 670 Series 2.2.3.5
  • Hitachi Energy Relion 670/650/SAM600-IO 2.2.5.2
  • Hitachi Energy Relion 650 1.3.0.8

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-065-02 updated cvss 7.2

Hitachi Energy Relion 670/650/SAM600-IO

  • Hitachi Energy Relion 650 series >=1.0.0.0, <1.0.1, >=1.1.0.0, <1.1.1, >=1.2.0.0, <1.2.1, >=1.3.0.0, <=1.3.0.7 Hitachi Energy Relion 670 series >=2.0.0.0, <=2.0.0.14, >=2.1.0.0, <=2.1.0.4, >=2.2.0.0, <2.2.1, >=2.2.1.0, <=2.2.1.7
    affected: vendor fix, mitigation
  • Hitachi Energy Relion SAM600-IO >=2.2.1.0, <=2.2.1.7, >=2.2.5.0, <=2.2.5.1
    affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-21-343-01 updated cvss 7.2

Hitachi Energy GMS600, PWC600, and Relion

  • Hitachi Energy GMS600 1.3.0, 1.3.1.0, 1.2.0 Hitachi Energy PWC600 1.0.1.0, 1.0.1.1, 1.0.1.3, 1.1.0.1 Hitachi Energy Relion 650 series 1.2 *, 1.3 *, 1.0 *, 1.1 * Hitachi Energy Relion 670 series 2.2.2 *, >= 2.2.3, <= 2.2.3.4, 2.0 * Hitachi Energy Relion 670/650 series 2.2.0 *, 2.1 *, 2.2.4 * Hitachi Energy Relion 670/650/SAM600-IO series 2.2.1 *, 2.2.5 <= 2.2.5.1
    affected: fixed in 1.3.0.8, mitigation “Relion 670 series Version 2.2.3: Update to Version 2.2.3.5” hitachienergy.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

  • Hitachi Energy Relion 670 Series
  • Hitachi Energy Relion 670/650 Series
  • Hitachi Energy Relion 670/650/SAM600-IO
  • Hitachi Energy Relion 650
  • Hitachi Energy GMS600
  • Hitachi Energy PWC600

Classification

Weakness
  • CWE-274 Improper Handling of Insufficient Privileges
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.