CVE-2021-35535: Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network…

PriorityP344high8.1CVSS 3.1

AVNACHPRNUINSUCHIHAH

EPSS

0.57%

42.7th percentile

Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process where an older version of VxWorks is loaded prior to application firmware booting, could exploit the vulnerability in the older version of VxWorks and cause a denial-of-service on the product. This issue affects: Hitachi Energy Relion 670 Series 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.3. Hitachi Energy Relion 670/650 Series 2.2.0 all revisions; 2.2.4 all revisions. Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
hitachi_energy	relion_670_650_sam600-io	—	—
hitachi_energy	relion_670_650_series	—	—
hitachi_energy	relion_670_650_series	—	—
hitachi_energy	relion_670_series	—	—
hitachi_energy	relion_670_series	>= 2.2.3 < 2.2.3.3	2.2.3.3
hitachienergy	relion_650_firmware	—	—
hitachienergy	relion_650_firmware	—	—
hitachienergy	relion_650_firmware	—	—
hitachienergy	relion_670_firmware	—	—
hitachienergy	relion_670_firmware	—	—
hitachienergy	relion_670_firmware	—	—
hitachienergy	relion_670_firmware	—	—
hitachienergy	relion_670_firmware	2.2.3 – 2.2.3.3	—
hitachienergy	relion_sam600-io_firmware	—	—

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.