What’s Vulnerable › Vulnerabilities

CVE-2021-27416: Cross-site scripting in Hitachi ABB Power Grids Ellipse EAM

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-11 · updated 2026-06-17
• Weakness: CWE-79

Description

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of confidential information, or even the takeover of the user’s session.

Affected products

• Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM): before 9.0.26 — fixed in 9.0.26

How to fix

Upgrade to a fixed version: Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) 9.0.26. Check the vendor advisory for mitigations.

References

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-01
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-01

Get alerted when CVE-2021-27416 or the next vulnerability affects your stack