ICSA-25-065-02: Hitachi Energy Relion 670/650/SAM600-IO

Summary

Hitachi Energy is aware of a vulnerability report from U.S. Department of Energy CyTRICS researcher of a vulnerability in the Relion® 670/650/SAM600-IO series versions listed below. Remediation is available for some versions. Recommended actions for each affected version are listed in the Recommended Immediate Actions Section. An attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. Consequently, exploitation may lead to unauthorized modifications on data/firmware, and/or to permanently disabling the product. CVE-2021-35534: A vulnerability exists in the database schema inside the product. An attacker could exploit the vulnerability by first gaining access to credentials of any account or to have access to a session ticket issued for an account. After that, via the configuration tool that accesses the proprietary Open Database Connectivity (ODBC) protocol (TCP 2102), the database table can be manipulated for privilege escalation which then allowed unauthorized modification or to permanently disabling of the device.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-25-065-02
Status: Final · version 4
Initial release: 2021-11-04
Last revised: 2025-02-25 (4 revisions)
Vendor: Hitachi Energy
Critical infrastructure sectors: Multiple
Deployed: Worldwide
Vendor headquarters: Switzerland

Republished vendor advisory. This CISA CSAF advisory was converted from Hitachi Energy PSIRT's CSAF advisory.

Support: For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.

General Mitigation Factors: Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. For instance, Open Database Connectivity (ODBC) protocol that is used for device configuration should be limited within the substation only. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

Credit: Robert Erbes (U.S. Department of Energy CyTRICS)

Affected products (3)

Relion 670 series — >=2.2.0.0|<2.2.1, >=2.2.1.0|<=2.2.1.7, >=2.2.2.0|<=2.2.2.4, >=2.2.3.0|<=2.2.3.4, >=2.2.4.0|<=2.2.4.2, >=2.2.5.0|<=2.2.5.1, 2.2.1.8, 2.2.2.5, 2.2.3.5, 2.2.4.3, 2.2.5.2, >=2.1.0.0|<=2.1.0.4 …
Relion 650 series — >=2.2.0.0|<2.2.1, >=2.2.1.0|<=2.2.1.7, >=2.2.4.0|<=2.2.4.2, >=2.2.5.0|<=2.2.5.1, 2.2.1.8, 2.2.4.3, 2.2.5.2, >=2.1.0.0|<=2.1.0.4, >=1.3.0.0|<=1.3.0.7, 2.1.0.5, 1.3.0.8, >=1.2.0.0|<1.2.1 …
Relion SAM600-IO — >=2.2.1.0|<=2.2.1.7, >=2.2.5.0|<=2.2.5.1, 2.2.1.8, 2.2.5.2

Revision history (4)

2025-02-25 — v4: Update on Section Recommended Immediate Actions
2023-03-14 — v3: Update on Section Recommended Immediate Actions
2021-12-07 — v2: Update on Section Recommended Immediate Actions
2021-11-04 — v1: Initial version.

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2021-35534	CWE-274 Improper Handling of Insufficient Privileges	7.2 High	A vulnerability exists in the database schema inside the product. An attacker could exploit the vulnerability by first gaining access to credentials of any account or to have access to a session ticket issued for an account. After that, via the configuration tool that accesses the proprietary Open Database Connectivity (ODBC) protocol (TCP 2102), the database table can be manipulated for privilege escalation which then allowed unauthorized modification or to permanently disabling of the device. Vendor fix: Update to Relion 670/650/SAM600-IO series version 2.2.1.8 Vendor fix: Update to Relion 670 series version 2.2.2.5 Vendor fix: Update to Relion 670 series version 2.2.3.5 Affected, fixed & timeline Affected: Relion 670 series >=2.0.0.0\|<=2.0.0.14 Relion 670 series >=2.1.0.0\|<=2.1.0.4 Relion 670 series >=2.2.0.0\|<2.2.1 Relion 670 series >=2.2.1.0\|<=2.2.1.7 Relion 670 series >=2.2.2.0\|<=2.2.2.4 Relion 670 series >=2.2.4.0\|<=2.2.4.2 Relion 670 series >=2.2.5.0\|<=2.2.5.1 Relion 650 series >=1.0.0.0\|<1.0.1 Relion 650 series >=1.1.0.0\|<1.1.1 Relion 650 series >=1.2.0.0\|<1.2.1 Relion 650 series >=1.3.0.0\|<=1.3.0.7 Relion 650 series >=2.1.0.0\|<=2.1.0.4 Relion 650 series >=2.2.0.0\|<2.2.1 Relion 650 series >=2.2.1.0\|<=2.2.1.7 Relion 650 series >=2.2.4.0\|<=2.2.4.2 … and 4 more Vendor fix: Update to Relion 670/650 series version 2.2.4.3 Vendor fix: Update to Relion 670/650/SAM600-IO series version 2.2.5.2 Vendor fix: Update to Relion 670/650 series version 2.1.0.5 Vendor fix: Update to Relion 670/650 series version 2.0.0.14 Vendor fix: Update to Relion 650 series version 1.3.0.8 Mitigation: Refer to the General Mitigation Factors/Workaround Section for the current mitigation strategy. Mitigation: Refer to the Mitigation Factors/Workaround Section for the current mitigation strategy or upgrade to Relion 650 series version 1.3.

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2021-35534	7.2 High	Hitachi Energy Relion 670 Series Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.

CyberzSOC