What is CVE-2023-2621?

CVE-2023-2621 is a medium-severity vulnerability in Hitachi Energy Mach System Software, classified under Path Traversal. CVSS score: 6.5/10. Published 2023-11-01.

How severe is CVE-2023-2621?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Path Traversal in Hitachi Energy Mach System Software

CVE-2023-2621

The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can exploit this vulnerability by uploading a crafted ZIP archive via the network to McFeeder’s service endpoint.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.005 (39.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Hitachi Energy Mach System Software — versions 5.0
Hitachienergy Modular_advanced_control_for_hvdc

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cybersecurity@hitachienergy.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-2621?: CVE-2023-2621 is a medium-severity vulnerability in Hitachi Energy Mach System Software, classified under Path Traversal. CVSS score: 6.5/10. Published 2023-11-01.
How severe is CVE-2023-2621?: Medium severity. CVSS v3 base score is 6.5 out of 10.