CVE-2019-18253

CRITICAL

An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside ...

Affects 2 products across 1 vendor.

BCS7.34
CVSS 3.110.0
EPSS2.0%
Percentile80th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-22: Path Traversal

Attacker manipulates file path inputs to access files outside the intended directory.

Related Attack Patterns (CAPEC)
CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
via CWE-22
CAPEC-76 Manipulating Web Input to File System Calls
via CWE-22
CAPEC-78 Using Escaped Slashes in Alternate Encoding
via CWE-22
CAPEC-79 Using Slashes in Alternate Encoding
via CWE-22
CAPEC-126 Path Traversal
via CWE-22

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2019. A critical vulnerability affects Hitachienergy systems (CVE-2019-18253). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2019-GLOBAL-136608-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2019-18253?
This vulnerability was disclosed in 2019. A critical vulnerability affects Hitachienergy systems (CVE-2019-18253). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2019-18253?
CVE-2019-18253 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 2.0%.
Is CVE-2019-18253 actively exploited?
No confirmed active exploitation of CVE-2019-18253 as of 2026-09-25.
How do I remediate CVE-2019-18253?
Priority: MEDIUM.
What systems are affected by CVE-2019-18253?
CVE-2019-18253 affects: Hitachienergy, Hitachienergy.
Vulnerability Details
CVE IDCVE-2019-18253
BSIDBS-2019-GLOBAL-136608-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2019-11-27
Last Modified2026-06-17
ICS Relevance90%
Weakness (CWE)
Path Traversal
SourceNVD
Official Description

An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductFixed Version
Hitachienergy Relion 670 Firmware —
Hitachienergy Relion 670 —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: September 2026 | Threat Age: 2496 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash1cb9f86b46ee20955384571ad7ac55eeaf029d458c1131edfb5214bf6bdf8ce87aa09783f69acee956a3b2ba15ef0baa7a2e03479467f4937c0826a68d8b45f7
Related CVEs affecting Hitachienergy
CVE-2024-2013 10.0 An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / ... CVE-2022-3927 9.8 The affected products store both public and private key that are used to sig... CVE-2019-5620 9.8 ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Mi... CVE-2018-14805 9.8 ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP... CVE-2021-40342 9.8 In the DES implementation, the affected product versions use a default key f...
View all Hitachienergy CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →