CVE-2023-2625

State: Published
Severity: 9.0 Critical
Published: Jun 28, 2023
Updated: Dec 4, 2024
Reserved: May 10, 2023

Description

A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user interface that will be executed by the system.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Hitachi Energy

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
TXpert Hub CoreTec 4Hitachi Energy	TXpert Hub CoreTec 4 version 2.0.Affected TXpert Hub CoreTec 4 version 2.1.Affected TXpert Hub CoreTec 4 version 2.2.Affected TXpert Hub CoreTec 4 version 2.3.Affected TXpert Hub CoreTec 4 version 2.4.*Affected TXpert Hub CoreTec 4 version 3.0.1Not affected

References

https://search.abb.com/library/Download.aspx?DocumentID=8DBD000163&LanguageCode=en&DocumentPartId=&Action=Launch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.