HTTP Response Splitting in Hitachi Energy’s MSM Product
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per E-Mail, could trick the user into downloading malicious software onto his computer. This issue affects: Hitachi Energy MSM V2.2 and prior versions.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hitachi Energy | MSM | v2.2 – V2.2 | — | No fix listed | CNA |
- MSM VendorHitachi Energy Affected v2.2 – V2.2 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hitachienergy:modular_switchgear_monitoring_firmware:*:*:*:*:*:*:*:* | up to 2.2.0 | Vulnerable | Hitachi Energy |
| cpe:2.3:h:hitachienergy:modular_switchgear_monitoring:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hitachi Energy |
- cpe:2.3:o:hitachienergy:modular_switchgear_monitoring_firmware:*:*:*:*:*:*:*:* Versions up to 2.2.0 Vulnerable ·Hitachi Energy
- cpe:2.3:h:hitachienergy:modular_switchgear_monitoring:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hitachi Energy
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40336
- 2026-10-03 Alias added: GHSA-3885-gg9g-8j6j
References
More Hitachi Energy Modular Switchgear Monitoring Firmware vulnerabilities
- TI-2022-03099 IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products CVSS 3.1HIGH 7.5
- TI-2021-17407 Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product CVSS 3.1HIGH 8.8
- TI-2021-08743 Specially Crafted IEC 61850 Protocol Sequence Vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2021-40336 · CVE Program
- CVE-2021-40336 · NVD
- FIRST EPSS
- GHSA-3885-gg9g-8j6j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences