Read the docs
TI-2019-13270 Aliases CVE-2019-18253GHSA-qjjj-g2xr-56qr

Path traversal in Relion 670 Series

Priority MEDIUM 47CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory.

Why it matters now

EPSS 0.0198 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Relion 670 Series1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior—No fix listedCNA
  • Relion 670 Series Vendor— Affected 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:*before 1p1r26; 1.2 to before 1.2.3.17; 2.0 to before 2.0.0.10; 2.1 to before 2.1.0.1VulnerableHitachi Energy
cpe:2.3:h:hitachienergy:relion_670:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi Energy
  • cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:* Versions before 1p1r26; 1.2 to before 1.2.3.17; 2.0 to before 2.0.0.10; 2.1 to before 2.1.0.1 Vulnerable ·Hitachi Energy
  • cpe:2.3:h:hitachienergy:relion_670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18253
  2. 2026-10-03 Alias added: GHSA-qjjj-g2xr-56qr

References

Advisory 1

  • TI-2022-03099 IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products CVSS 3.1HIGH 7.5
  • TI-2021-14266 Insufficient Security Control Vulnerability CVSS 3.1HIGH 8.1
  • TI-2021-08743 Specially Crafted IEC 61850 Protocol Sequence Vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-13264 Improper input validation in Relion 650 and 670 Series CVSS 3.1HIGH 7.5
  • TI-2021-14265 Insufficient Security Control Vulnerability CVSS 3.1HIGH 7.2
  • TI-2023-04170 A vulnerability exists in the input validation of the GOOSE messages where out of range… CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences