Weak default credential associated with TCP port 26
Priority MEDIUM 40CWE-521Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-521.
Summary
Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A.
Why it matters now
EPSS 0.00655 51st percentileScored 2026-11-07
Fix Fixed FOX61x (Hitachi Energy): R15AXCM20 (Hitachi Energy): R15A
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi Energy | FOX61x | R15A to before R15A | R15A | Patch available | CNA |
| Hitachi Energy | XCM20 | R15A to before R15A | R15A | Patch available | CNA |
- FOX61x VendorHitachi Energy Affected R15A to before R15A Fixed in R15A Patch available CNA
- XCM20 VendorHitachi Energy Affected R15A to before R15A Fixed in R15A Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachienergy:fox615_firmware:*:*:*:*:*:*:*:* | before r15a | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:fox615:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
| cpe:2.3:o:hitachienergy:xcm20_firmware:*:*:*:*:*:*:*:* | before r15a | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:xcm20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
- cpe:2.3:o:hitachienergy:fox615_firmware:*:*:*:*:*:*:*:* Versions before r15a Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:fox615:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
- cpe:2.3:o:hitachienergy:xcm20_firmware:*:*:*:*:*:*:*:* Versions before r15a Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:xcm20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
Remediation
- Fix · CNA FOX61x (Hitachi Energy) Fixed in R15A
- Fix · CNA XCM20 (Hitachi Energy) Fixed in R15A
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Hitachi Energy FOX61x, XCM20 R15A
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-17406 SSH activation problem in the proprietary management protocol (port TCP 5558)Priority LOW 39
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40333
- 2026-10-03 Alias added: GHSA-94q6-cm2f-p4pc
- 2026-10-13 EPSS moved to the 50th–90th percentile
References
More Hitachi Energy Fox615 Firmware vulnerabilities
- TI-2021-17406 SSH activation problem in the proprietary management protocol (port TCP 5558) CVSS 3.1HIGH 8.6
Sources
- CVE-2021-40333 · CVE Program
- CVE-2021-40333 · NVD
- FIRST EPSS
- GHSA-94q6-cm2f-p4pc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences