Read the docs
TI-2021-17406 Aliases CVE-2021-40334GHSA-4cmw-rq6h-3v7m

SSH activation problem in the proprietary management protocol (port TCP 5558)

Priority LOW 39CWE-431Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that exploits the vulnerability by activating SSH on port TCP 5558 to cause disruption to the NMS and NE communication. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A.

Why it matters now

EPSS 0.0099 62nd percentileScored 2026-11-07
Fix Fixed FOX61x (Hitachi Energy): R15AXCM20 (Hitachi Energy): R15A

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi EnergyFOX61xR15A to before R15AR15APatch availableCNA
Hitachi EnergyXCM20R15A to before R15AR15APatch availableCNA
  • FOX61x VendorHitachi Energy Affected R15A to before R15A Fixed in R15A Patch available CNA
  • XCM20 VendorHitachi Energy Affected R15A to before R15A Fixed in R15A Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:hitachienergy:fox615_firmware:*:*:*:*:*:*:*:*before r15aVulnerableHitachi Energy
cpe:2.3:h:hitachienergy:fox615:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi Energy
cpe:2.3:o:hitachienergy:xcm20_firmware:*:*:*:*:*:*:*:*before r15aVulnerableHitachi Energy
cpe:2.3:h:hitachienergy:xcm20:-:*:*:*:*:*:*:*not specified by NVDRunning onHitachi Energy
  • cpe:2.3:o:hitachienergy:fox615_firmware:*:*:*:*:*:*:*:* Versions before r15a Vulnerable ·Hitachi Energy
  • cpe:2.3:h:hitachienergy:fox615:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
  • cpe:2.3:o:hitachienergy:xcm20_firmware:*:*:*:*:*:*:*:* Versions before r15a Vulnerable ·Hitachi Energy
  • cpe:2.3:h:hitachienergy:xcm20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy

Remediation

  • Fix · CNA FOX61x (Hitachi Energy) Fixed in R15A
  • Fix · CNA XCM20 (Hitachi Energy) Fixed in R15A

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Hitachi Energy FOX61x, XCM20 R15A

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-17405 Weak default credential associated with TCP port 26Priority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40334
  2. 2026-10-03 Alias added: GHSA-4cmw-rq6h-3v7m

References

Advisory 2

  • TI-2021-17405 Weak default credential associated with TCP port 26 CVSS 3.1CRITICAL 9.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences