CVE-2021-40333

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-521

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-403347.5Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker that CVE-2021-403358.8A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent re CVE-2021-403368.8A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HT CVE-2021-403375.4Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take adv CVE-2021-403385.3Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path CVE-2021-403397.5Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploi CVE-2021-40347.8A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow u CVE-2021-403407.5Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP CVE-2021-403415.5DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Networ CVE-2021-403429.8In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obt CVE-2021-403437.8An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their CVE-2021-403447.2An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitr