Password in Memory Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB)
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.
Summary
Insufficiently Protected Credentials vulnerability in client environment of Hitachi ABB Power Grids Retail Operations and Counterparty Settlement Billing (CSB) allows an attacker or unauthorized user to access database credentials, shut down the product and access or alter. This issue affects: Hitachi ABB Power Grids Retail Operations version 5.7.2 and prior versions. Hitachi ABB Power Grids Counterparty Settlement Billing (CSB) version 5.7.2 and prior versions.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi ABB Power Grids | Retail Operations | 5.7.2 – 5.7.2 | — | No fix listed | CNA |
| Hitachi ABB Power Grids | Counterparty Settlement and Billing (CSB) | 5.7.2 – 5.7.2 | — | No fix listed | CNA |
- Retail Operations VendorHitachi ABB Power Grids Affected 5.7.2 – 5.7.2 Fixed in — No fix listed CNA
- Counterparty Settlement and Billing (CSB) VendorHitachi ABB Power Grids Affected 5.7.2 – 5.7.2 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hitachienergy:counterparty_settlement_and_billing:*:*:*:*:*:*:*:* | before 5.7.3 | Vulnerable | Hitachi Energy |
| cpe:2.3:a:hitachienergy:retail_operations:*:*:*:*:*:*:*:* | before 5.7.3 | Vulnerable | Hitachi Energy |
- cpe:2.3:a:hitachienergy:counterparty_settlement_and_billing:*:*:*:*:*:*:*:* Versions before 5.7.3 Vulnerable ·Hitachi Energy
- cpe:2.3:a:hitachienergy:retail_operations:*:*:*:*:*:*:*:* Versions before 5.7.3 Vulnerable ·Hitachi Energy
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35529
- 2026-10-03 Alias added: GHSA-6c6g-x473-fqjx
References
More Hitachi ABB Power Grids vulnerabilities
- TI-2021-14258 Password Autocomplete Vulnerability in Hitachi ABB Power Grids eSOMS Application CVSS 3.1HIGH 7.5
- TI-2021-14257 Storage of Sensitive Information Vulnerability in Hitachi ABB Power Grids System Data Manager – SDM600 Product CVSS 3.1HIGH 7.8
- TI-2021-09227 Stored XSS vulnerability in Ellipse APM CVSS 3.1MEDIUM 6.3
- TI-2021-08905 User interface misrepresentation of critical information in Hitachi ABB Power Grids Ellipse EAM CVSS 3.1MEDIUM 6.1
- TI-2021-08906 Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-35529 · CVE Program
- CVE-2021-35529 · NVD
- FIRST EPSS
- GHSA-6c6g-x473-fqjx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences