CVE-2021-35533

Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-5-104 function of Hitachi Energy RTU500 series allows an attacker to cause the receiving RTU500 CMU of which the BCI is enabled to reboot when receiving a specially crafted message. By default, BCI IEC 60870-5-104 function is disabled (not configured). This issue affects: Hitachi Energy RTU500 series CMU Firmware version 12.0.* (all versions); CMU Firmware version 12.2.* (all versions); CMU Firmware version 12.4.* (all versions).

• CWE-20
• CWE-20

• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000063&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000063&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory

Published

Nov 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35528Improper Access Control vulnerability in the application aut…7.1
• CVE-2021-35529Insufficiently Protected Credentials vulnerability in client…7.2
• CVE-2021-3553A Server-Side Request Forgery (SSRF) vulnerability in the EP…7.5
• CVE-2021-35530A vulnerability in the application authentication and author…6.7
• CVE-2021-35531Improper Input Validation vulnerability in a particular conf…6.7
• CVE-2021-35532A vulnerability exists in the file upload validation part of…6.7
• CVE-2021-35534Insufficient security control vulnerability in internal data…7.2
• CVE-2021-35535Insecure Boot Image vulnerability in Hitachi Energy Relion R…8.1
• CVE-2021-35536Vulnerability in the Oracle Deal Management product of Oracl…8.1
• CVE-2021-35537Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-35538Vulnerability in the Oracle VM VirtualBox product of Oracle …7.8
• CVE-2021-35539Vulnerability in the Oracle Solaris product of Oracle System…6.5