Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product
Priority LOW 33CWE-312Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-312 and CWE-863.
Summary
Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive information. This issue affects: Hitachi ABB Power Grids System Data Manager – SDM600 1.2 versions prior to FP2 HF6 (Build Nr. 1.2.14002.257).
Why it matters now
EPSS 0.00127 2nd percentileScored 2026-11-08
Fix Fixed System Data Manager – SDM600 (Hitachi ABB Power Grids): FP2 HF6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi ABB Power Grids | System Data Manager – SDM600 | 1.2 to before FP2 HF6 | FP2 HF6 | Patch available | CNA |
- System Data Manager – SDM600 VendorHitachi ABB Power Grids Affected 1.2 to before FP2 HF6 Fixed in FP2 HF6 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachiabb-powergrids:sdm600_firmware:*:*:*:*:*:*:*:* | 1.2 to before 1.2.14002.257 | Vulnerable | Hitachi ABB Power Grids |
| cpe:2.3:h:hitachienergy:sdm600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
- cpe:2.3:o:hitachiabb-powergrids:sdm600_firmware:*:*:*:*:*:*:*:* Versions 1.2 to before 1.2.14002.257 Vulnerable ·Hitachi ABB Power Grids
- cpe:2.3:h:hitachienergy:sdm600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
Remediation
- Fix · CNA System Data Manager – SDM600 (Hitachi ABB Power Grids) Fixed in FP2 HF6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35526
- 2026-10-03 Alias added: GHSA-jhp7-5v8q-5544
References
Advisory 2
- https://search.abb.com/library/Download.aspx?utm_campaign=&utm_content=2021.08_5051_Cybersecurity%20Advisory%3A&utm_medium=email&utm_source=Eloqua&DocumentID=9AKK107992A4700&LanguageCode=en&DocumentPartId=&Action=Launch&elqTrackId=ba79ef3d8aec4a4fad6c0cbe06d33d6c&elq=1bda419954724e908db108def16646a5&elqaid=3638&elqat=1&elqCampaignId=
- https://us-cert.cisa.gov/ics/advisories/icsa-21-250-02
Sources
- CVE-2021-35526 · CVE Program
- CVE-2021-35526 · NVD
- FIRST EPSS
- GHSA-jhp7-5v8q-5544 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences