Insufficient Security Control Vulnerability
Priority LOW 35CWE-274Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. Consequently, exploitation may lead to unauthorized modifications on data/firmware, and/or to permanently disabling the product. This issue affects: Hitachi Energy Relion 670 Series 2.0 all revisions; 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.5. Hitachi Energy Relion 670/650 Series 2.1 all revisions. 2.2.0 all revisions; 2.2.4 all revisions; Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions; 2.2.5 versions prior to 2.2.5.2. Hitachi Energy Relion 650 1.0 all revisions. 1.1 all revisions; 1.2 all revisions; 1.3 versions prior to 1.3.0.8; Hitachi Energy GMS600 1.3.0; 1.3.0.1; 1.2.0. Hitachi Energy PWC600 1.0.1 version 1.0.1.4 and prior versions; 1.1.0 version 1.1.0.1 and prior versions.
Why it matters now
EPSS 0.01792 78th percentileScored 2026-11-07
Fix Fixed Relion 670 Series (Hitachi Energy): 2.2.3.5Relion 670/650/SAM600-IO (Hitachi Energy): 2.2.5.2+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi Energy | Relion 670 Series | 2.0 all revisions; 2.2.2 all revisions; 2.2.3 to before 2.2.3.5 | 2.2.3.5 | Patch available | CNA |
| Hitachi Energy | Relion 670/650 Series | 2.2.0 all revisions; 2.2.4 all revisions; 2.1 all revisions | — | No fix listed | CNA |
| Hitachi Energy | Relion 670/650/SAM600-IO | 2.2.1 all revisions; 2.2.5 to before 2.2.5.2 | 2.2.5.2 | Patch available | CNA |
| Hitachi Energy | Relion 650 | 1.1 all revisions; 1.2 all revisions; 1.0 all revisions; 1.3 to before 1.3.0.8 | 1.3.0.8 | Patch available | CNA |
| Hitachi Energy | GMS600 | 1.3.0; 1.3.1.0 1.3.0.1; 1.2.0 | — | No fix listed | CNA |
| Hitachi Energy | PWC600 | 1.0.1 – 1.0.1.4; 1.1.0 – 1.1.0.1 | — | No fix listed | CNA |
- Relion 670 Series VendorHitachi Energy Affected 2.0 all revisions; 2.2.2 all revisions; 2.2.3 to before 2.2.3.5 Fixed in 2.2.3.5 Patch available CNA
- Relion 670/650 Series VendorHitachi Energy Affected 2.2.0 all revisions; 2.2.4 all revisions; 2.1 all revisions Fixed in — No fix listed CNA
- Relion 670/650/SAM600-IO VendorHitachi Energy Affected 2.2.1 all revisions; 2.2.5 to before 2.2.5.2 Fixed in 2.2.5.2 Patch available CNA
- Relion 650 VendorHitachi Energy Affected 1.1 all revisions; 1.2 all revisions; 1.0 all revisions; 1.3 to before 1.3.0.8 Fixed in 1.3.0.8 Patch available CNA
- GMS600 VendorHitachi Energy Affected 1.3.0; 1.3.1.0 1.3.0.1; 1.2.0 Fixed in — No fix listed CNA
- PWC600 VendorHitachi Energy Affected 1.0.1 – 1.0.1.4; 1.1.0 – 1.1.0.1 Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachienergy:gms600_firmware:1.2.0:*:*:*:*:*:*:* | 1.2.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:gms600_firmware:1.3.0:*:*:*:*:*:*:* | 1.3.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:gms600_firmware:1.3.1.0:*:*:*:*:*:*:* | 1.3.1.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:gms600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_670_firmware:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_670_firmware:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.2:*:*:*:*:*:*:* | 2.2.2 | Vulnerable | Hitachi Energy |
- cpe:2.3:o:hitachienergy:gms600_firmware:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:gms600_firmware:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:gms600_firmware:1.3.1.0:*:*:*:*:*:*:* Versions 1.3.1.0 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:gms600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_670_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_670_firmware:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_670_firmware:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Hitachi Energy
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.3:*:*:*:*:*:*:* | 2.2.3 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.4:*:*:*:*:*:*:* | 2.2.4 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.5:*:*:*:*:*:*:* | 2.2.5 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:relion_670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:1.1.0:*:*:*:*:*:*:* | 1.1.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:1.2.0:*:*:*:*:*:*:* | 1.2.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:1.3.0:*:*:*:*:*:*:* | 1.3.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.4:*:*:*:*:*:*:* | 2.2.4 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.5:*:*:*:*:*:*:* | 2.2.5 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:relion_650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_sam600-io_firmware:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:relion_sam600-io_firmware:2.2.5:*:*:*:*:*:*:* | 2.2.5 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:relion_sam600-io:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
| cpe:2.3:o:hitachienergy:pwc600_firmware:1.0.1.0:*:*:*:*:*:*:* | 1.0.1.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:pwc600_firmware:1.0.1.1:*:*:*:*:*:*:* | 1.0.1.1 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:pwc600_firmware:1.0.1.3:*:*:*:*:*:*:* | 1.0.1.3 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:pwc600_firmware:1.0.1.4:*:*:*:*:*:*:* | 1.0.1.4 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:pwc600_firmware:1.1.0.0:*:*:*:*:*:*:* | 1.1.0.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:o:hitachienergy:pwc600_firmware:1.1.0.1:*:*:*:*:*:*:* | 1.1.0.1 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:pwc600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
- cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_670_firmware:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:relion_670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_650_firmware:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:relion_650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_sam600-io_firmware:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:relion_sam600-io_firmware:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:relion_sam600-io:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
- cpe:2.3:o:hitachienergy:pwc600_firmware:1.0.1.0:*:*:*:*:*:*:* Versions 1.0.1.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:pwc600_firmware:1.0.1.1:*:*:*:*:*:*:* Versions 1.0.1.1 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:pwc600_firmware:1.0.1.3:*:*:*:*:*:*:* Versions 1.0.1.3 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:pwc600_firmware:1.0.1.4:*:*:*:*:*:*:* Versions 1.0.1.4 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:pwc600_firmware:1.1.0.0:*:*:*:*:*:*:* Versions 1.1.0.0 Vulnerable ·Hitachi Energy
- cpe:2.3:o:hitachienergy:pwc600_firmware:1.1.0.1:*:*:*:*:*:*:* Versions 1.1.0.1 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:pwc600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
Remediation
- Fix · CNA Relion 670 Series (Hitachi Energy) Fixed in 2.2.3.5
- Fix · CNA Relion 670/650/SAM600-IO (Hitachi Energy) Fixed in 2.2.5.2
- Fix · CNA Relion 650 (Hitachi Energy) Fixed in 1.3.0.8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35534
- 2026-10-03 Alias added: GHSA-72pf-j5fj-gg32
References
Advisory 3
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000058&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000059&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000060&LanguageCode=en&DocumentPartId=&Action=Launch
More Hitachi Energy Gms600 Firmware vulnerabilities
- TI-2022-03099 IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products CVSS 3.1HIGH 7.5
- TI-2021-08743 Specially Crafted IEC 61850 Protocol Sequence Vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2021-35534 · CVE Program
- CVE-2021-35534 · NVD
- FIRST EPSS
- GHSA-72pf-j5fj-gg32 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences