Read the docs
TI-2021-14259 Aliases CVE-2021-35528GHSA-xg7j-hjr6-42q2

Improper access control in Hitachi Energy Retail Operations

Priority LOW 31CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Billing (CSB) allows an attacker to execute a modified signed Java Applet JAR file. A successful exploitation may lead to data extraction or modification of data inside the application. This issue affects: Hitachi Energy Retail Operations 5.7.3 and prior versions. Hitachi Energy Counterparty Settlement and Billing (CSB) 5.7.3 prior versions.

Why it matters now

EPSS 0.00259 17th percentileScored 2026-11-07
Fix Fixed Retail Operations (Hitachi Energy): 5.7.3.1Counterparty Settlement and Billing (CSB) (Hitachi Energy): 5.7.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi EnergyRetail Operations5.7.3 to before 5.7.3.15.7.3.1Patch availableCNA
Hitachi EnergyCounterparty Settlement and Billing (CSB)5.7.3 to before 5.7.3.15.7.3.1Patch availableCNA
  • Retail Operations VendorHitachi Energy Affected 5.7.3 to before 5.7.3.1 Fixed in 5.7.3.1 Patch available CNA
  • Counterparty Settlement and Billing (CSB) VendorHitachi Energy Affected 5.7.3 to before 5.7.3.1 Fixed in 5.7.3.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hitachienergy:counterparty_settlements_and_billing:*:*:*:*:*:*:*:*up to 5.7.3VulnerableHitachi Energy
cpe:2.3:a:hitachienergy:retail_operations:*:*:*:*:*:*:*:*up to 5.7.3VulnerableHitachi Energy
  • cpe:2.3:a:hitachienergy:counterparty_settlements_and_billing:*:*:*:*:*:*:*:* Versions up to 5.7.3 Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:retail_operations:*:*:*:*:*:*:*:* Versions up to 5.7.3 Vulnerable ·Hitachi Energy

Remediation

  • Fix · CNA Retail Operations (Hitachi Energy) Fixed in 5.7.3.1
  • Fix · CNA Counterparty Settlement and Billing (CSB) (Hitachi Energy) Fixed in 5.7.3.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-35528
  2. 2026-10-03 Alias added: GHSA-xg7j-hjr6-42q2

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences