Read the docs
TI-2021-05256 Aliases CVE-2021-22278GHSA-m4rm-456c-72hq

Certificate verification vulnerability in Update Manager of PCM600 Engineering Tool

Priority LOW 29CWE-295Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on computer which has PCM600 installed.

Why it matters now

EPSS 0.00128 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ABBPCM6002.7 and later; up to 2.10—No fix listedCNA
ABBPCM600 Update Manager2.1; 2.1.0.4; 2.2; 2.2.0.1; 2.2.0.2; 2.2.0.23; 2.3.0.60; 2.4.20041.1; 2.4.20119.2—No fix listedCNA
Hitachi EnergyPCM6002.7 and later; up to 2.10—No fix listedCNA
Hitachi EnergyPCM600 Update Manager2.1; 2.1.0.4; 2.2; 2.2.0.1; 2.2.0.2; 2.2.0.23; 2.3.0.60; 2.4.20041.1; 2.4.20119.2—No fix listedCNA
  • PCM600 VendorABB Affected 2.7 and later; up to 2.10 Fixed in — No fix listed CNA
  • PCM600 Update Manager VendorABB Affected 2.1; 2.1.0.4; 2.2; 2.2.0.1; 2.2.0.2; 2.2.0.23; 2.3.0.60; 2.4.20041.1; 2.4.20119.2 Fixed in — No fix listed CNA
  • PCM600 VendorHitachi Energy Affected 2.7 and later; up to 2.10 Fixed in — No fix listed CNA
  • PCM600 Update Manager VendorHitachi Energy Affected 2.1; 2.1.0.4; 2.2; 2.2.0.1; 2.2.0.2; 2.2.0.23; 2.3.0.60; 2.4.20041.1; 2.4.20119.2 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:abb:update_manager:2.1:*:*:*:*:*:*:*2.1VulnerableABB
cpe:2.3:a:abb:update_manager:2.1.0.4:*:*:*:*:*:*:*2.1.0.4VulnerableABB
cpe:2.3:a:abb:update_manager:2.2:*:*:*:*:*:*:*2.2VulnerableABB
cpe:2.3:a:abb:update_manager:2.2.0.1:*:*:*:*:*:*:*2.2.0.1VulnerableABB
cpe:2.3:a:abb:update_manager:2.2.0.2:*:*:*:*:*:*:*2.2.0.2VulnerableABB
cpe:2.3:a:abb:update_manager:2.2.0.23:*:*:*:*:*:*:*2.2.0.23VulnerableABB
cpe:2.3:a:abb:update_manager:2.3.0.60:*:*:*:*:*:*:*2.3.0.60VulnerableABB
cpe:2.3:a:abb:update_manager:2.4.20041.1:*:*:*:*:*:*:*2.4.20041.1VulnerableABB
cpe:2.3:a:abb:update_manager:2.4.20119.2:*:*:*:*:*:*:*2.4.20119.2VulnerableABB
cpe:2.3:a:abb:update_manager:*:*:*:*:*:*:*:*2.7 – 2.10VulnerableABB
  • cpe:2.3:a:abb:update_manager:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:2.1.0.4:*:*:*:*:*:*:* Versions 2.1.0.4 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:2.2.0.1:*:*:*:*:*:*:* Versions 2.2.0.1 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:2.2.0.2:*:*:*:*:*:*:* Versions 2.2.0.2 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:2.2.0.23:*:*:*:*:*:*:* Versions 2.2.0.23 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:2.3.0.60:*:*:*:*:*:*:* Versions 2.3.0.60 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:2.4.20041.1:*:*:*:*:*:*:* Versions 2.4.20041.1 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:2.4.20119.2:*:*:*:*:*:*:* Versions 2.4.20119.2 Vulnerable ·ABB
  • cpe:2.3:a:abb:update_manager:*:*:*:*:*:*:*:* Versions 2.7 – 2.10 Vulnerable ·ABB
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:hitachienergy:pcm600:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi Energy
  • cpe:2.3:h:hitachienergy:pcm600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22278
  2. 2026-10-03 Alias added: GHSA-m4rm-456c-72hq

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences