Details of VAR-202106-0959

ID

VAR-202106-0959

CVE

CVE-2021-27196

TITLE

ABB Relion Input validation error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202104-350

DESCRIPTION

Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU500 Series, FOX615 (TEGO1), MSM, GMS600, PWC600 allows an attacker with access to the IEC 61850 network with knowledge of how to reproduce the attack, as well as the IP addresses of the different IEC 61850 access points (of IEDs/products), to force the device to reboot, which renders the device inoperable for approximately 60 seconds. This vulnerability affects only products with IEC 61850 interfaces. This issue affects: Hitachi ABB Power Grids Relion 670 Series 1.1; 1.2.3 versions prior to 1.2.3.20; 2.0 versions prior to 2.0.0.13; 2.1; 2.2.2 versions prior to 2.2.2.3; 2.2.3 versions prior to 2.2.3.2. Hitachi ABB Power Grids Relion 670/650 Series 2.2.0 versions prior to 2.2.0.13. Hitachi ABB Power Grids Relion 670/650/SAM600-IO 2.2.1 versions prior to 2.2.1.6. Hitachi ABB Power Grids Relion 650 1.1; 1.2; 1.3 versions prior to 1.3.0.7. Hitachi ABB Power Grids REB500 7.3; 7.4; 7.5; 7.6; 8.2; 8.3. Hitachi ABB Power Grids RTU500 Series 7.x version 7.x and prior versions; 8.x version 8.x and prior versions; 9.x version 9.x and prior versions; 10.x version 10.x and prior versions; 11.x version 11.x and prior versions; 12.x version 12.x and prior versions. Hitachi ABB Power Grids FOX615 (TEGO1) R1D02 version R1D02 and prior versions. Hitachi ABB Power Grids MSM 2.1.0 versions prior to 2.1.0. Hitachi ABB Power Grids GMS600 1.3.0 version 1.3.0 and prior versions. Hitachi ABB Power Grids PWC600 1.0 versions prior to 1.0.1.4; 1.1 versions prior to 1.1.0.1. A remote attacker could exploit this vulnerability to force the device to reboot

Trust: 0.99

sources: NVD: CVE-2021-27196 // VULMON: CVE-2021-27196

AFFECTED PRODUCTS

vendor:	hitachienergy	model:	reb500	scope:	lt	version:	8.2.0.5	Trust: 1.0
vendor:	hitachienergy	model:	reb500	scope:	gte	version:	7.3	Trust: 1.0
vendor:	hitachienergy	model:	reb500	scope:	lt	version:	7.60.19	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	lt	version:	2.2.3.2	Trust: 1.0
vendor:	abb	model:	pwc600	scope:	gte	version:	1.0	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	lt	version:	2.0.0.13	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	eq	version:	2.1	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	lt	version:	2.2.1.6	Trust: 1.0
vendor:	abb	model:	rtu500	scope:	eq	version:	10.0	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	gte	version:	1.2.3	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	gte	version:	2.2.0	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	gte	version:	2.2.1	Trust: 1.0
vendor:	abb	model:	pwc600	scope:	lt	version:	1.0.1.4	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	gte	version:	1.3	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	lt	version:	1.2.3.20	Trust: 1.0
vendor:	abb	model:	pwc600	scope:	lt	version:	1.1.0.1	Trust: 1.0
vendor:	abb	model:	gms600	scope:	lte	version:	1.3.0	Trust: 1.0
vendor:	abb	model:	rtu500	scope:	eq	version:	12.0	Trust: 1.0
vendor:	abb	model:	rtu500	scope:	eq	version:	9.0	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	gte	version:	2.2.3	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	lt	version:	2.2.0.13	Trust: 1.0
vendor:	abb	model:	fox615 tego1	scope:	lt	version:	r2a16	Trust: 1.0
vendor:	abb	model:	relion sam600-io	scope:	lt	version:	2.2.1.6	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	eq	version:	1.2	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	gte	version:	2.0	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	eq	version:	1.1	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	lt	version:	1.3.0.7	Trust: 1.0
vendor:	abb	model:	pwc600	scope:	gte	version:	1.1	Trust: 1.0
vendor:	abb	model:	rtu500	scope:	eq	version:	8.0	Trust: 1.0
vendor:	abb	model:	rtu500	scope:	eq	version:	7.0	Trust: 1.0
vendor:	hitachienergy	model:	reb500	scope:	gte	version:	8.3	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	lt	version:	2.2.2.3	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	lt	version:	2.2.1.6	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	gte	version:	2.2.2	Trust: 1.0
vendor:	hitachienergy	model:	reb500	scope:	lte	version:	8.3.1.0	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	gte	version:	2.2.1	Trust: 1.0
vendor:	abb	model:	relion sam600-io	scope:	gte	version:	2.2.1	Trust: 1.0
vendor:	abb	model:	rtu500	scope:	eq	version:	11.0	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	eq	version:	2.1	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	gte	version:	2.2.0	Trust: 1.0
vendor:	hitachienergy	model:	modular switchgear monitoring	scope:	lt	version:	2.1.0	Trust: 1.0
vendor:	abb	model:	relion 650	scope:	eq	version:	1.1	Trust: 1.0
vendor:	abb	model:	relion 670	scope:	lt	version:	2.2.0.13	Trust: 1.0
vendor:	hitachienergy	model:	reb500	scope:	gte	version:	8.2	Trust: 1.0

sources: NVD: CVE-2021-27196

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2021-27196
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202104-350
value:	HIGH
Trust: 0.6

NVD:	CVE-2021-27196
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0

NVD:	CVE-2021-27196
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: NVD: CVE-2021-27196 // CNNVD: CNNVD-202104-350

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.0

sources: NVD: CVE-2021-27196

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202104-350

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202104-350

CONFIGURATIONS

sources: NVD: CVE-2021-27196

PATCH

title:

ABB Relion Security vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=146523

Trust: 0.6

sources: CNNVD: CNNVD-202104-350

EXTERNAL IDS

db:	NVD	id:	CVE-2021-27196	Trust: 1.7
db:	ICS CERT	id:	ICSA-21-096-01	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.1160	Trust: 0.6
db:	CNNVD	id:	CNNVD-202104-350	Trust: 0.6
db:	VULMON	id:	CVE-2021-27196	Trust: 0.1

sources: VULMON: CVE-2021-27196 // NVD: CVE-2021-27196 // CNNVD: CNNVD-202104-350

REFERENCES

url:	https://search.abb.com/library/download.aspx?documentid=9akk107991a8934&languagecode=en&documentpartid=&action=launch	Trust: 1.6
url:	https://search.abb.com/library/download.aspx?documentid=9akk107991a9059&languagecode=en&documentpartid=&action=launch	Trust: 1.6
url:	https://search.abb.com/library/download.aspx?documentid=9akk107991a8936&languagecode=en&documentpartid=&action=launch	Trust: 1.6
url:	https://search.abb.com/library/download.aspx?documentid=9akk107991a9057&languagecode=en&documentpartid=&action=launch	Trust: 1.6
url:	https://search.abb.com/library/download.aspx?documentid=9akk107991a8937&languagecode=en&documentpartid=&action=launch	Trust: 1.6
url:	https://search.abb.com/library/download.aspx?documentid=9akk107991a9058&languagecode=en&documentpartid=&action=launch	Trust: 1.6
url:	https://search.abb.com/library/download.aspx?documentid=9akk107991a8932&languagecode=en&documentpartid=&action=launch	Trust: 1.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-096-01	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.1160	Trust: 0.6
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/199519	Trust: 0.1

sources: VULMON: CVE-2021-27196 // NVD: CVE-2021-27196 // CNNVD: CNNVD-202104-350

SOURCES

db:	VULMON	id:	CVE-2021-27196
db:	NVD	id:	CVE-2021-27196
db:	CNNVD	id:	CNNVD-202104-350

LAST UPDATE DATE

2023-04-22T23:07:33.304000+00:00

SOURCES UPDATE DATE

db:	NVD	id:	CVE-2021-27196	date:	2023-04-19T15:32:00
db:	CNNVD	id:	CNNVD-202104-350	date:	2021-07-09T00:00:00

SOURCES RELEASE DATE

db:	NVD	id:	CVE-2021-27196	date:	2021-06-14T22:15:00
db:	CNNVD	id:	CNNVD-202104-350	date:	2021-04-06T00:00:00