Read the docs
TI-2021-17414 Aliases CVE-2021-40342GHSA-747r-gwxx-f5r5

Use of default key for encryption

Priority MEDIUM 42CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. This issue affects * FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00303 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hitachi EnergyFOXMAN-UNFOXMAN-UN R16A; FOXMAN-UN R15B; FOXMAN-UN R15A; FOXMAN-UN R14B; FOXMAN-UN R14A; FOXMAN-UN R11B; FOXMAN-UN R11A; FOXMAN-UN R10C; FOXMAN-UN R9C—No fix listedCNA
Hitachi EnergyUNEMUNEM R16A; UNEM R15B; UNEM R15A; UNEM R14B; UNEM R14A; UNEM R11B; UNEM R11A; UNEM R10C; UNEM R9C—No fix listedCNA
  • FOXMAN-UN VendorHitachi Energy Affected FOXMAN-UN R16A; FOXMAN-UN R15B; FOXMAN-UN R15A; FOXMAN-UN R14B; FOXMAN-UN R14A; FOXMAN-UN R11B; FOXMAN-UN R11A; FOXMAN-UN R10C; FOXMAN-UN R9C Fixed in — No fix listed CNA
  • UNEM VendorHitachi Energy Affected UNEM R16A; UNEM R15B; UNEM R15A; UNEM R14B; UNEM R14A; UNEM R11B; UNEM R11A; UNEM R10C; UNEM R9C Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:hitachienergy:foxman-un:r9c:*:*:*:*:*:*:*r9cVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r10c:*:*:*:*:*:*:*r10cVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r11a:*:*:*:*:*:*:*r11aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r11b:*:*:*:*:*:*:*r11bVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r14a:*:*:*:*:*:*:*r14aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r14b:*:*:*:*:*:*:*r14bVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r15a:*:*:*:*:*:*:*r15aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r15b:*:*:*:*:*:*:*r15bVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:foxman-un:r16a:*:*:*:*:*:*:*r16aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r9c:*:*:*:*:*:*:*r9cVulnerableHitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r9c:*:*:*:*:*:*:* Versions r9c Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r10c:*:*:*:*:*:*:* Versions r10c Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r11a:*:*:*:*:*:*:* Versions r11a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r11b:*:*:*:*:*:*:* Versions r11b Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r14a:*:*:*:*:*:*:* Versions r14a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r14b:*:*:*:*:*:*:* Versions r14b Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r15a:*:*:*:*:*:*:* Versions r15a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r15b:*:*:*:*:*:*:* Versions r15b Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:foxman-un:r16a:*:*:*:*:*:*:* Versions r16a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r9c:*:*:*:*:*:*:* Versions r9c Vulnerable ·Hitachi Energy
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hitachienergy:unem:r10c:*:*:*:*:*:*:*r10cVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r11a:*:*:*:*:*:*:*r11aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r11b:*:*:*:*:*:*:*r11bVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r14a:*:*:*:*:*:*:*r14aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r14b:*:*:*:*:*:*:*r14bVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r15a:*:*:*:*:*:*:*r15aVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r15b:*:*:*:*:*:*:*r15bVulnerableHitachi Energy
cpe:2.3:a:hitachienergy:unem:r16a:*:*:*:*:*:*:*r16aVulnerableHitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r10c:*:*:*:*:*:*:* Versions r10c Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r11a:*:*:*:*:*:*:* Versions r11a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r11b:*:*:*:*:*:*:* Versions r11b Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r14a:*:*:*:*:*:*:* Versions r14a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r14b:*:*:*:*:*:*:* Versions r14b Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r15a:*:*:*:*:*:*:* Versions r15a Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r15b:*:*:*:*:*:*:* Versions r15b Vulnerable ·Hitachi Energy
  • cpe:2.3:a:hitachienergy:unem:r16a:*:*:*:*:*:*:* Versions r16a Vulnerable ·Hitachi Energy

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40342
  2. 2026-10-03 Alias added: GHSA-747r-gwxx-f5r5

References

Advisory 2

  • TI-2024-01871 Heap-based buffer overflow in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
  • TI-2024-01873 Authentication bypass in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 10.0
  • TI-2024-01872 Authentication bypass in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
  • TI-2022-03602 Hard-coded credentials in Hitachi Energy FOXMAN-UN CVSS 3.1CRITICAL 9.8
  • TI-2022-03604 Communication between the client and server partially using CORBA over TCP/IP CVSS 3.1CRITICAL 9.8
  • TI-2024-18618 A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server… CVSS 3.1HIGH 8.0
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences