CVE-2021-35535
Insufficient Security Control Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- Hitachi Energy
Description
Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process where an older version of VxWorks is loaded prior to application firmware booting, could exploit the vulnerability in the older version of VxWorks and cause a denial-of-service on the product. This issue affects: Hitachi Energy Relion 670 Series 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.3. Hitachi Energy Relion 670/650 Series 2.2.0 all revisions; 2.2.4 all revisions. Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| Hitachi EnergyCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.67% · top 48% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
Affected products
Hitachi Energy · Relion 670 Series
- affected 2.2.2 all revisions
- affected 2.2.3 – < 2.2.3.3
Hitachi Energy · Relion 670/650 Series
- affected 2.2.0 all revisions
- affected 2.2.4 all revisions
Hitachi Energy · Relion 670/650/SAM600-IO
- affected 2.2.1 all revisions
What to do
Solution: Refer to the cybersecurity advisories at https://www.hitachienergy.com/cybersecurity/alerts-and-notifications
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-35535)Record last updated .