User authentication bypass in TXpert Hub CoreTec 4
Priority LOW 29CWE-288Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-288.
Summary
A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.
Why it matters now
EPSS 0.00223 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi Energy | TXpert Hub CoreTec 4 version | 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1 | — | No fix listed | CNA |
- TXpert Hub CoreTec 4 version VendorHitachi Energy Affected 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.1:*:*:*:*:*:*:* | 2.1.1 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.2:*:*:*:*:*:*:* | 2.1.2 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.3:*:*:*:*:*:*:* | 2.1.3 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:txpert_hub_coretec_4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
- cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:txpert_hub_coretec_4_firmware:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:txpert_hub_coretec_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35530
- 2026-10-03 Alias added: GHSA-fqpp-wf47-38vw
More Hitachi Energy Txpert Hub Coretec 4 Firmware vulnerabilities
- TI-2022-03099 IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products CVSS 3.1HIGH 7.5
- TI-2021-14263 Firmware upload verification bypass in TXpert Hub CoreTec 4 CVSS 3.1MEDIUM 6.7
- TI-2021-14262 Remote Code Execution in TXpert Hub CoreTec 4 CVSS 3.1MEDIUM 6.7
Sources
- CVE-2021-35530 · CVE Program
- CVE-2021-35530 · NVD
- FIRST EPSS
- GHSA-fqpp-wf47-38vw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences